CVE-2026-53876: RadiX AX6600 Router Root Command Injection Vulnerability

Technical summary

CVE-2026-53876 is an OS command injection vulnerability (CWE-78) in the RadiX AX6600 router's web administrative interface. The vulnerability stems from insufficient input validation or sanitization of user-supplied parameters that are passed to system command execution functions. An attacker with valid administrative credentials can craft specially formatted input that breaks out of the intended command context and executes arbitrary shell commands with root privileges. The CVSS 3.0 score of 7.2 reflects a high-severity network-accessible vulnerability with no additional complexity required, though it does require elevated (admin-level) authentication.

Business impact

Compromise of an admin-authenticated session exposes the router to complete takeover. An attacker controlling the router can intercept, modify, or exfiltrate all network traffic passing through it, launch man-in-the-middle attacks against connected devices, pivot into the internal network, or use the router as a staging point for lateral movement. For organizations or homes relying on this router for perimeter security and network segmentation, successful exploitation creates a critical breach in the security posture. Data confidentiality, integrity, and availability are all at direct risk.

Affected systems

RadiX AX6600 WiFi 6 Tri-Band Gaming Router is the confirmed affected product. Specific firmware versions are not enumerated in current advisories. Organizations and users running this model should assume all currently deployed instances may be vulnerable unless patched. Verify the exact affected firmware versions and any available patches through the vendor's official security advisory.

Exploitability

Exploitability is limited by the authentication requirement—the attacker must first obtain valid administrator credentials for the web console. Once authenticated, exploitation is straightforward: the vulnerability requires no special network conditions, no user interaction, and no additional complexity. The barrier to exploitation is credential compromise, social engineering of an admin, or insider access. In environments where admin credentials are poorly managed, shared, or reused, risk is substantially elevated.

Remediation

Apply vendor-supplied security patches or firmware updates to the RadiX AX6600 as soon as available. Until a patch is deployed, restrict access to the web administrative console using network-level controls (firewall rules limiting admin interface access to trusted IP ranges) and ensure all administrative credentials follow strong password hygiene practices. Consider disabling remote administration features if not required. Monitor router logs for signs of unauthorized command injection attempts.

Patch guidance

Consult the RadiX vendor security advisory for the specific patched firmware version and deployment instructions. Prioritize patching given the high CVSS score and root-level execution risk. Test patches in a non-production environment first if possible. Many router vendors provide firmware updates through the web console or downloadable firmware images; follow the vendor's documented update procedure to avoid bricking the device. Verify that the patch version corresponds to official vendor releases, not third-party modified firmware.

Detection guidance

Review router web server logs and authentication logs for suspicious admin login activity or timing anomalies. Monitor for encoded or escaped characters in HTTP request parameters that may indicate command injection attempts. Network-level detection is difficult without deep packet inspection, but look for unusual administrative API calls or configuration changes that correlate with unexplained downtime or performance changes. Endpoint Detection and Response (EDR) tools on devices connected to the router may detect unusual outbound traffic patterns if the compromised router initiates connections. Baseline router behavior and network traffic patterns to identify deviations.

Why prioritize this

Despite the authentication requirement, this vulnerability merits immediate prioritization because: (1) root-level command execution with no sandboxing; (2) routers are persistent, always-on infrastructure often overlooked in patch cycles; (3) compromise enables supply-chain style attacks on all downstream devices; (4) the attack surface is the router's web interface, which may be exposed to the internet if remote administration is enabled; and (5) recovery from router compromise typically requires factory reset and reconfiguration, making it operationally disruptive.

Risk score, explained

The CVSS 3.0 score of 7.2 (HIGH) reflects a network-accessible vulnerability with high attack complexity mitigated by privilege requirements. The vector CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H indicates network accessibility (AV:N), low attack complexity (AC:L), high privileges required (PR:H), no user interaction needed (UI:N), unchanged scope (S:U), and complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H). The score is not higher because admin authentication is a required precondition; however, once that barrier is cleared, the impact is total system compromise. In threat environments where credential compromise is common or where admin credentials are shared, the practical risk exceeds the base score.

Frequently asked questions