Description

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the macfilter function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit the macfilter function to inject malicious commands and obtain root privileges on the underlying system.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-09T00:16:48.410Z",
  "pubdate": "2026-08-09T00:16:48.410Z",
  "executiveSummary": "An unauthenticated command injection vulnerability exists within the macfilter function of the MSI Radix AXE6600 router firmware version v781521. This security flaw allows remote attackers to execute arbitrary system commands with root privileges on the underlying operating system.\nThe vulnerability represents a critical risk to network security, as successful exploitation enables full device compromise, potential lateral movement within the local network, and persistent unauthorized access.\nAttackers can leverage this vulnerability by sending specially crafted input to the vulnerable macfilter function without requiring prior authentication or user interaction.\nThe inherent danger of this remote code execution flaw necessitates immediate vendor patching or network-level access restriction to prevent complete administrative takeover of the affected networking equipment.",
  "technicalDetails": "The vulnerability resides in the macfilter function of the MSI Radix AXE6600 router firmware version v781521, specifically within the handling of user-supplied input intended for MAC address filtering configurations.\nThe root cause of the issue is improper input sanitization and validation. The firmware directly passes parameters associated with the macfilter feature into underlying system shell interfaces or execution functions without adequately stripping shell metacharacters.\nThe attack flow begins when a remote attacker crafts a malicious HTTP request or interface interaction containing injected command payloads directed at the vulnerable macfilter component.\nDue to the lack of input filtering, the operating system executes the injected shell commands concurrently with or in place of the intended MAC filtering logic.\nBecause the web application or underlying daemon runs with elevated privileges, the execution of arbitrary commands results in the immediate acquisition of root privileges on the affected system.\nThe network exposure is broad if the management interface is accessible from untrusted networks, and the exploitation requirements are minimal since the macfilter function processes input without requiring valid session authentication.\nPost-exploitation impact includes complete system compromise, firmware modification, interception of network traffic, and persistence mechanisms established via root-level access."
}