The MSI Radix AXE6600 router firmware version v781521 contains an OS command injection vulnerability in its macfilter function. This vulnerability allows unauthenticated remote attackers to inject and execute arbitrary OS commands on the affected device, resulting in root-level access. The CVSS 4.0 base score is 9.3 (critical), reflecting the vulnerability's ease of exploitation and high impact. No vendor advisory or patch information is currently available, and the vulnerability is publicly disclosed as of August 8, 2026.

Successful exploitation of this vulnerability enables remote attackers to execute arbitrary commands on the router with root privileges, potentially leading to full device compromise. This could allow attackers to control the device, disrupt network operations, or pivot to other internal systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict remote access to the device's management interfaces and monitor for suspicious activity related to the macfilter function.