CVE-2026-71993 is a command injection vulnerability in the openvpn function of MSI Radix AXE6600 router firmware version v781521. Attackers can leverage the macfilter function to inject malicious commands remotely, resulting in arbitrary command execution with root privileges on the underlying system. The vulnerability is classified under CWE-78 (Improper Neutralization of Special Elements used in an OS Command). No patch or remediation information is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows remote attackers to execute arbitrary commands on the affected router with root privileges, leading to complete compromise of the device. This can result in full control over the router, including potential interception or manipulation of network traffic, disruption of service, and unauthorized access to internal networks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the router's management interfaces from untrusted networks and monitor for unusual activity related to the openvpn and macfilter functions.