CVE-2026-71993

Published Aug 9, 2026

Last updated 13 days ago

CVSS critical 9.3

Overview

Description
MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the openvpn function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit the macfilter function to inject malicious commands and obtain root privileges on the underlying system.
Source
disclosure@vulncheck.com
NVD status
Received

Risk scores

CVSS 4.0

Type
Secondary
Base score
9.3
Impact score
-
Exploitability score
-
Vector string
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Severity
CRITICAL

CVSS 3.1

Type
Secondary
Base score
9.8
Impact score
5.9
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
CRITICAL

Weaknesses

disclosure@vulncheck.com
CWE-78

Social media

Hype score
Not currently trending

  1. šŸšØ MSI Radix AXE6600 ā€” 11 CVE Bundle, ALL CVSS 9.8 CVE-2026-71983 through CVE-2026-71993: Command injection across every router function. No patch available. Restrict access NOW. ā†’ https://t.co/yO5ulObobi #cybersecurity #infosec #MSI #RouterSecurity #CISAKEV #ThreatInte

    @ThreatAft

    9 Aug 2026

    57 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

References

Sources include official advisories and independent security research.