A critical command injection vulnerability in the MSI Radix AXE6600 router allows unauthenticated remote attackers to achieve full system compromise.

This is an OS command injection flaw (CWE-78) located within the porTrigger function. An unauthenticated attacker can leverage the alg function to inject and execute malicious commands on the underlying operating system.

With a CVSS score of 9.8, this vulnerability represents a critical threat to network security. An attacker gaining root access can manipulate traffic, bypass security controls, or gain a foothold within the internal network. This could lead to significant data breaches and total loss of device control.

Immediate Action: Locate all MSI Radix AXE6600 units and apply the latest firmware update from the vendor to remediate the command injection vector.

Proactive Monitoring: Review system logs for signs of anomalous command execution and monitor for unexpected traffic patterns originating from the router.

Compensating Controls: Implement strict network access control lists to limit access to the router interface and consider isolating the device on a management-only VLAN.

Public Exploit Available: Unknown

This vulnerability demands immediate attention due to its critical severity and the ease with which an unauthenticated attacker can execute arbitrary commands. Administrators must ensure all devices are updated to the latest firmware version to prevent potential remote code execution.