Vulnerabilidades de Msi

CVE-2026-82908 Alta · 8.8 CWE-189 31/08/2026

MSI Dragon Center MMIO Write Path NTIOLib_X64.sys MmioWritePath integer overflow

A vulnerability was found in MSI Dragon Center up to 2.0.155.0. Affected by this vulnerability is the function MmioWritePath in the library NTIOLib_X64.sys of the component MMIO Write Path Handler. Performing a manipulation of the argument count/elementSize results in integer overflow. The attack requires a local approach. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

CVE-2026-71993 Crítica · 9.8 CWE-78 08/08/2026

MSI Radix AXE6600 v781521 Command Injection via openvpn function

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the openvpn function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit the macfilter function to inject malicious commands and obtain root privileges on the underlying system.

CVE-2026-71992 Crítica · 9.8 CWE-78 08/08/2026

MSI Radix AXE6600 v781521 Command Injection via macfilter

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the macfilter function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit the macfilter function to inject malicious commands and obtain root privileges on the underlying system.

CVE-2026-71991 Crítica · 9.8 CWE-78 08/08/2026

MSI Radix AXE6600 v781521 Command Injection via TelnetSSH Function

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the TelnetSSH function used for Telnet configuration that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the Telnet configuration interface to inject malicious commands and obtain root privileges on the underlying system.

CVE-2026-71990 Crítica · 9.8 CWE-78 08/08/2026

MSI Radix AXE6600 v781521 Command Injection via TelnetSSH Function

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the TelnetSSH function used for SSH configuration that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the SSH configuration interface to inject malicious commands and obtain root privileges on the underlying system.

CVE-2026-71989 Crítica · 9.8 CWE-78 08/08/2026

MSI Radix AXE6600 v781521 Command Injection via porTrigger function

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the porTrigger function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the alg function to execute malicious commands and obtain root privileges on the underlying system.

CVE-2026-71988 Crítica · 9.8 CWE-78 08/08/2026

MSI Radix AXE6600 v781521 Command Injection via portFw function

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the portFw function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the alg function to execute malicious commands and obtain root privileges on the underlying system.

CVE-2026-71987 Crítica · 9.8 CWE-78 08/08/2026

MSI Radix AXE6600 v781521 Command Injection via alg function

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the alg function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the alg function to execute malicious commands and obtain root privileges on the underlying system.

CVE-2026-71986 Crítica · 9.8 CWE-78 08/08/2026

MSI Radix AXE6600 v781521 Command Injection via dmz Function

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the dmz function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the dmz function to execute malicious commands and obtain root privileges on the underlying system.

CVE-2026-71985 Crítica · 9.8 CWE-78 08/08/2026

MSI Radix AXE6600 v781521 Command Injection via accesscontrol Function

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the accesscontrol function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the accesscontrol function to execute malicious commands and obtain root privileges on the underlying system.

CVE-2026-71984 Crítica · 9.8 CWE-78 08/08/2026

MSI Radix AXE6600 v781521 Command Injection via urlfilter

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the urlfilter function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit the urlfilter function to inject malicious commands and obtain root privileges on the underlying system.

CVE-2026-71983 Crítica · 9.8 CWE-78 08/08/2026

MSI Radix AXE6600 v781521 Command Injection via wps.cgi

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the wps.cgi interface that allows remote attackers to execute arbitrary commands by injecting malicious input through the pin2g, pin5g, or pin6g parameters. Attackers can exploit these unsanitized parameters to execute arbitrary commands on the affected device and obtain root privileges.

CVE-2026-6102 Alta · 7.8 CWE-346 29/07/2026

MSI Center NTIOLib_X64 Origin Validation Error Local Privilege Escalation Vulnerability

MSI Center NTIOLib_X64 Origin Validation Error Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MSI Center. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the NTIOLib_X64.sys driver. The issue results from insufficient validation of the origin of commands. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-28935.

CVE-2026-37454 Alta · 7.5 CWE-200 25/06/2026

Exposure of Sensitive Information em Msi Center

Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote attacker to obtain sensitive information via the 3DES-ECB encryption

CVE-2026-37453 Alta · 7.5 CWE-200 25/06/2026

Exposure of Sensitive Information em Msi Center

Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote attacker to obtain sensitive information via the MSI_SERVICE_2 pipe