CVE-2026-53876: RadiX AX6600 WiFi 6 Tri-Band Gaming Router contains an OS command injection vulnerability, which may lead to arbitrary command execution with the root privilege by a user who logs in to the web console as an administrator

Synopsis

OS command injection in the RadiX AX6600 WiFi 6 Tri-Band Gaming Router allows an authenticated administrator to execute arbitrary commands with root privileges. The vulnerability is reachable over the network through the router's web console, but requires a valid administrator account to exploit. Successful exploitation gives the attacker full root-level command execution on the device. No fix version has been published yet; HarborGuard tracks this advisory and will flag a patched-image rebuild as soon as an upstream fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The web console is exposed over the network, meaning an attacker must be able to reach the router's management interface across the network to attempt exploitation.

• AuthenticationRequired

  A valid administrator account is required; any attacker without admin credentials cannot reach the vulnerable code path.

• Victim interactionNot required

  No action from another user or victim is needed; the attacker operates entirely through their own authenticated session.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental preconditions beyond network access and admin credentials.

Blast Radius

• Attacker executes arbitrary OS commands as root, gaining full control over the router's operating system.
• Attacker reads sensitive configuration data, stored credentials, and network traffic passing through the device.
• Attacker modifies routing rules, firewall settings, or DNS configuration to redirect or intercept traffic.
• Attacker can crash or reboot the device, disrupting network connectivity for all clients depending on the router.