The MSI Radix AXE6600 router firmware version v781521 contains an OS command injection vulnerability in its urlfilter function. This vulnerability allows remote attackers to inject malicious commands that the system executes with root privileges, potentially leading to full system compromise. The vulnerability has a CVSS 4.0 base score of 9.3, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently documented, and no known exploits in the wild have been reported.

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary OS commands on the router with root privileges. This can lead to complete compromise of the device, including unauthorized access, control over network traffic, and potential pivoting to other internal systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the affected device and monitor for suspicious activity targeting the urlfilter function.