CVE-2026-71984

This is a command injection vulnerability in the urlfilter function of the Radix AXE6600 router firmware. The function interfaces with kernel packet filtering (iptables), and the vulnerability arises from unsanitized input being passed to a shell invocation. This is the same pattern that has produced dozens of router CVEs over the past decade — the fix quality is what matters, not just the CVE existence. When assessing this vulnerability in the firmware, your priority is determining whether the patch refactors the invocation pattern or merely adds a blacklist check. Pull the commit diff: if the fix introduces input sanitization (parameterized execution, allowlist validation, or replacement of system() with exec-family functions), this is a genuine remediation. If the fix adds a regex filter on the urlfilter parameter, the vulnerability is patched but the underlying architecture remains vulnerable — the next feature requiring kernel interaction will likely reproduce the same pattern. Check the firmware SDK context. Determine whether the development environment provides safe wrappers for system calls that the developer didn't use, or whether no such tooling exists. If safe wrappers were available but unused, this is an organizational security culture failure. If the toolchain offers no safe alternative to shell invocation, this vulnerability is structural to the firmware development process and will recur. The blast radius extends beyond the AXE6600. If the urlfilter component shares code ancestry with other Radix products — and the discussion indicates this is likely — a perfect fix in one product line doesn't propagate automatically. Audit the other product firmware for the same urlfilter implementation. The CVE scores severity but not exposure: the lag between disclosure and vendor patch in consumer router firmware routinely exceeds 90 days, and downstream products may remain vulnerable far longer.

Reviewed through automated stages and approved by a human before publication.