The MSI Radix AXE6600 router firmware version v781521 contains an OS command injection vulnerability in the wps.cgi interface. Specifically, the parameters pin2g, pin5g, and pin6g are improperly neutralized, enabling remote attackers to inject malicious input that leads to arbitrary command execution on the device with root privileges. This vulnerability is remotely exploitable without authentication and does not require user interaction. The CVSS 4.0 base score is 9.3, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the vulnerability is not in a cloud service environment.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected MSI Radix AXE6600 device with root privileges. This can lead to full compromise of the device, including unauthorized control, data theft, or disruption of network services. The vulnerability affects device confidentiality, integrity, and availability severely.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the device's management interfaces, especially the wps.cgi endpoint, from untrusted networks. Monitor for unusual activity and consider network-level controls to limit exposure. Avoid exposing the device management interface to the internet.