Description

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the dmz function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the dmz function to execute malicious commands and obtain root privileges on the underlying system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-09T00:16:47.500Z",
  "pubdate": "2026-08-09T00:16:47.500Z",
  "executiveSummary": "A command injection vulnerability has been identified in the MSI Radix AXE6600 router firmware version v781521. The vulnerability resides within the dmz function of the device management interface, exposing a critical security flaw in how user-supplied input is handled.\nSuccessful exploitation of this vulnerability allows remote attackers to execute arbitrary system commands with root privileges on the underlying operating system. This grants complete administrative control over the affected hardware, severely compromising device integrity and local network security.\nThe attack vector targets the network-exposed routing functionality, enabling malicious actors to bypass standard security boundaries without complex prerequisite conditions.\nThe risk implications are critical, as full root access allows attackers to intercept traffic, pivot into the internal network, install persistent backdoors, or repurpose the router for malicious activities.\nMitigation requires applying vendor-supplied firmware updates or restricting administrative access to trusted internal networks until a patch is deployed.",
  "technicalDetails": "The vulnerability is classified as a command injection flaw located in the dmz function of the MSI Radix AXE6600 router running firmware version v781521.\nThe root cause stems from insufficient input sanitization and validation within the vulnerable component. When parameters destined for the dmz configuration are processed, user-supplied input is directly or unsafely concatenated into system shell commands executed by the underlying operating system.\nExploitation occurs when an attacker crafts a malicious HTTP request targeting the dmz function, injecting shell metacharacters or command separators (such as semicolons, pipe symbols, or backticks) followed by arbitrary payload commands.\nThe attack flow proceeds as follows: First, the attacker identifies the network exposure of the device management interface. Second, the attacker formulates an HTTP request destined for the dmz configuration handler containing the injected command payload. Third, the web application backend passes the unsanitized input to the system shell for execution. Finally, the injected commands are executed with root privileges, resulting in immediate system compromise.\nNetwork exposure is present if the vulnerable management interface is accessible via the Local Area Network (LAN) or Wide Area Network (WAN) if remote management is enabled.\nAuthentication and privilege requirements depend on whether the interface enforces session validation prior to reaching the vulnerable dmz function, though remote exploitation paradigms typically assume an attacker can interact with the management service.\nThe post-exploitation impact includes arbitrary code execution, complete system takeover, unauthorized modification of network routing rules, interception of sensitive data traversing the device, and full root-level persistence on the underlying Linux-based system."
}