MSI vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-82908 A vulnerability was found in MSI Dragon Center up to 2.0.155.0.High 8.5 · Aug 31, 2026
• CVE-2026-71993 MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the openvpn function that allows remote attackers to execute arbCritical 9.3 · Aug 8, 2026
• CVE-2026-71992 MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the macfilter function that allows remote attackers to execute aCritical 9.3 · Aug 8, 2026
• CVE-2026-71991 MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the TelnetSSH function used for Telnet configuration that allowsCritical 9.3 · Aug 8, 2026
• CVE-2026-71990 MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the TelnetSSH function used for SSH configuration that allows reCritical 9.3 · Aug 8, 2026
• CVE-2026-71989 MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the porTrigger function that allows remote attackers to execute Critical 9.3 · Aug 8, 2026
• CVE-2026-71988 MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the portFw function that allows remote attackers to execute arbiCritical 9.3 · Aug 8, 2026
• CVE-2026-71987 MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the alg function that allows remote attackers to execute arbitraCritical 9.3 · Aug 8, 2026
• CVE-2026-71986 MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the dmz function that allows remote attackers to execute arbitraCritical 9.3 · Aug 8, 2026
• CVE-2026-71985 MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the accesscontrol function that allows remote attackers to execuCritical 9.3 · Aug 8, 2026
• CVE-2026-71984 MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the urlfilter function that allows remote attackers to execute aCritical 9.3 · Aug 8, 2026
• CVE-2026-71983 MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the wps.cgi interface that allows remote attackers to execute arCritical 9.3 · Aug 8, 2026
• CVE-2026-6102 MSI Center NTIOLib_X64 Origin Validation Error Local Privilege Escalation Vulnerability.High 7.8 · Jul 29, 2026
• CVE-2026-37454 Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote attacker to obtain sensitive information via the 3DES-ECB encryptHigh 7.5 · Jun 25, 2026
• CVE-2026-37453 Insecure Permissions vulnerability in MSI NBFoundation Service v.2.0.2506.1201 allows a remote attacker to obtain sensitive information via the MSI_SERVICE_2 piHigh 7.5 · Jun 25, 2026
• CVE-2025-14303 Certain motherboard models developed by MSI has a Protection Mechanism Failure vulnerability.High 7 · Dec 16, 2025
• CVE-2025-27813 MSI Center before 2.0.52.0 has Missing PE Signature Validation.High 8.1 · Apr 10, 2025
• CVE-2025-27812 MSI Center before 2.0.52.0 allows TOCTOU Local Privilege Escalation.High 8.1 · Apr 10, 2025
• CVE-2024-36877 Micro-Star International Z-series motherboards (Z590, Z490, and Z790) and B-series motherboards (B760, B560, B660, and B460) with firmware 7D25v14, 7D25v17 to 7High 8.2 · Aug 12, 2024
• CVE-2024-3745 MSI Afterburner v4.6.6.16381 Beta 3 is vulnerable to an ACL Bypass vulnerability in the RTCore64.sys driver, which leads to triggering vulnerabilities like CVE-High 7.8 · May 18, 2024
• CVE-2021-32415 EXEMSI MSI Wrapper Versions prior to 10.0.50 and at least since version 6.0.91 will introduce a local privilege escalation vulnerability in installers it createHigh 7.8 · Dec 13, 2022
• CVE-2022-31877 An issue in the component MSI.TerminalServer.exe of MSI Center v1.0.41.0 allows attackers to escalate privileges via a crafted TCP packet.High 8.8 · Nov 28, 2022
• CVE-2022-38532 Micro-Star International Co., Ltd MSI Center 1.0.50.0 was discovered to contain a vulnerability in the component C_Features of MSI.CentralServer.exe.High 7.8 · Sep 19, 2022
• CVE-2022-34109 An issue in Micro-Star International MSI Feature Navigator v1.0.1808.0901 allows attackers to write arbitrary files to the directory \PromoPhoto\, regardless ofHigh 7.1 · Sep 12, 2022
• CVE-2022-34108 An issue in the Feature Navigator of Micro-Star International MSI Feature Nagivator v1.0.1808.0901 allows attackers to cause a Denial of Service (DoS) via a craHigh 7.1 · Sep 12, 2022