CVE-2026-71986

CVE-2026-71986 is a command injection vulnerability in MSI's Radix AXE6600 router firmware, specifically in the dmz configuration function. Attackers can achieve unauthenticated root-level remote code execution by supplying crafted input to the dmz interface. The severity is capped at 9.8 (Critical) by CVSS, but the actual risk is worse: dmz is the one router feature explicitly designed to expose internal hosts to external traffic, so a successful exploit gives attackers not just the router but a pivot point into every device behind it. Check your firmware version immediately. MSI has released patches for the AXE6600 — verify whether your deployed units are running a version that includes the security update. If you cannot confirm the patch is applied, treat the dmz function as actively exploitable and consider disabling it at the network perimeter until remediation completes. The vulnerability almost certainly stems from unsanitized user input being interpolated into a shell command within the dmz implementation. This is the same flaw class that has appeared in Netgear, TP-Link, and ASUS firmware in functionally identical code paths — the pattern of using shell commands for network configuration has been cross-vendor for over a decade. What makes this specific case worse is the blast radius: dmz is not a diagnostic tool or maintenance interface, it's a feature whose entire purpose is firewall bypass. The code that handles it should have received threat modeling scrutiny and explicit security review, because any flaw in this function directly exposes the entire internal network. On the remediation side, consumer router firmware update pipelines are broken. Even after MSI releases a patch, deployment lag measured in months is typical, and many devices never get updated. If you're deploying these devices in an enterprise or ISP context, your patch process needs explicit validation — don't assume the router's web interface will notify you or that auto-update is enabled. The exposure window between CVE publication and actual patch deployment on consumer hardware is the real systemic risk here, larger than any individual developer mistake.

Reviewed through automated stages and approved by a human before publication.