Overview

This page documents an ongoing security incident, and will be updated regularly.

Two major security vulnerabilities have been discovered in all models of MSI RadiX routers, on any firmware version older than v781845. The following devices are impacted:

RadiX AX6600 WiFi 6 Tri-Band Gaming Router
RadiX AX6600-E WiFi 6 Tri-Band Gaming Router
RadiX AXE6600 WiFi 6E Tri-Band Gaming Router

These vulnerabilities allow a remote and unauthenticated attacker to gain full control over a RadiX router as the root user. With this power, an attacker can issue destructive commands to corrupt the device, causing a permanent denial of service. They may also covertly spy on all network traffic, and install malware to modify the device’s behavior. After complete exploitation, changes cannot be reversed without modifications to internal hardware.

CWE-288 Authentication Bypass

CAN-2026-2035984

The RadiX routers implement access control through Web cookies. In the intended authentication flow, a user submits a valid username and password via the login screen, and the server responds with an authentication cookie. By including the cookie with their future requests, the user can then access restricted endpoints.

Only one endpoint is designed to be accessible without an authentication cookie: the login screen. However, due to an overly permissive pattern match, all endpoints can be accessed without authentication.

The flawed logic is contained in the custom Lighttpd module mod_cookie_auth.so. To check whether the user is on the login page, the authentication inappropriately calls the strstr() function from glibc to check if the the string /login.html is located at any position in the URL path, or crucially, query string. By inserting this value into the query string of any request, the attacker can skip authentication and immediately access any restricted endpoint.

if (strstr(requestUrl, "/login.html")) {
    return HANDLER_GO_ON;
}

Consider the URL of a typical request to a protected endpoint:

http://msirouter.login/cgi-bin/reboot.cgi

The router will always reject such a request unless an authentication cookie is sent. However, an attacker can decieve the router by adding the magic pattern to the query string:

http://msirouter.login/cgi-bin/reboot.cgi?/login.html

In this case, the router behaves as if the attacker is trying to reach the login page, and disables authentication. It will immediately proceed with the requested action and reboot.

This type of exploit falls into the category of CWE-288: Authentication Bypass Using an Alternate Path or Channel. Because the cookie authentication prevents unauthorized login, an attacker uses the alternate and unintended entry path that doesn’t require authentication.

CWE-78 OS Command Injection

CAN-2026-2035985

To set a WPS pincode, the router runs a shell script named wps.sh. To start the script, it invokes the system() function in glibc, inserting the user-controlled pincode at the end of the command, where it is intended to act as an argument to the shell script.

Unfortunately, this pincode is not sanitized, which allows an attacker to insert executable shell code in its place. The Lighttpd module that contains this vulnerability, wps.cgi, runs as the root user. Consequently, the shell code also executes as root. While limited to 105 or 106 characters at a time, this root shell can be used to gain complete control over the device.

if (strncmp(queryString, "pin2g", 5)) {
    char *token = strtok(queryString, "=");
    token = strtok(NULL, "=");
    snprintf(command, 128, "/bin/wps.sh ath6 PIN %s", token);
    system(command);
} else if (strncmp(queryString, "pin5g", 5)) {
    char *token = strtok(queryString, "=");
    token = strtok(NULL, "=");
    snprintf(command, 128, "/bin/wps.sh ath1 PIN %s", token);
    system(command);
} else if (strncmp(queryString, "pin6g", 5)) {
    char *token = strtok(queryString, "=");
    token = strtok(NULL, "=");
    snprintf(command, 128, "/bin/wps.sh ath11 PIN %s", token);
    system(command);
}

As an example, an attacker can combine both vulnerabilities like so:

http://msirouter.login/cgi-bin/wps.cgi?pin2g=/login.html;reboot

The strstr() function will detect the /login.html in the query string, and allow the request to proceed unauthenticated. Then, the full command string will be expanded into two sequential commands, separated by a semicolon:

/bin/wps.sh ath6 PIN /login.html;reboot

The wps.sh script will crash immediately because the pincode is not numeric, and then the injected shell code (reboot) will be executed.

This is a common and well-understood vulnerability type referred to as CWE-78 Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’).

A Note on Attack Surface

When the “Remote Management” setting is enabled, the RadiX routers allow all inbound traffic from the Internet, facilitating a completely remote (and unauthenticated) attack. In the default configuration, the setting is disabled, which would normally require the attacker to control another device on the local network. However, due to the design of major Web browsers, it is possible to initiate a remote attack from any website visited by a device on the router’s network. A single line of JavaScript will suffice:

fetch('http://msirouter.login/cgi-bin/wps.cgi?pin6g=/login.html;reboot')

CORS security protections prevent the site from reading the HTTP response, but the command will execute. Some newer browsers will show a short permission prompt, requiring a user to allow local network access before the attack can begin. Others allow the action to proceed silently, such as Mozilla Firefox before version 153, released just a month ago (July 21, 2026) at the time of writing.

Conclusion

Updates to patch these vulnerabilities are now available on MSI’s website. The vulnerable code has been removed in v781845 and above.

Timeline

May 13th, 2026: Reported backdoor to MSI
June 30th: MSI publishes fixes

Remote Code Execution Vulnerabilities in All MSI RadiX Routers