CVE-2026-53876 describes an OS command injection vulnerability in the RadiX AX6600 WiFi 6 Tri-Band Gaming Router. An attacker with administrator-level access to the router's web console can exploit improper neutralization of special elements in OS commands to execute arbitrary commands as root. This vulnerability requires high privileges (administrator login) and does not require user interaction beyond that. The CVSS 3.0 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an authenticated administrator to execute arbitrary OS commands with root privileges on the affected router. This can lead to full compromise of the device, including unauthorized control, data disclosure, modification, or disruption of service. The impact is high on confidentiality, integrity, and availability of the device.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrative access to the router's web console to trusted users only and monitor for suspicious activity. Do not expose the management interface to untrusted networks. Follow vendor updates closely for patches or official mitigations.