CVE-2026-36741

HighCVSS 7.2

Published: 13/05/2026(UTC)Updated: 30/06/2026(UTC)Translated: 01/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.09%

61th percentile - higher than 61% of all known CVEs

Summary

The U-SPEED AC1200 Gigabit Wi-Fi Router (Model T18-21K) V1.0 is vulnerable to Command Injection in the NTP configuration interface due to improper input sanitization. An authenticated user with NTP configuration permissions can inject arbitrary system commands.

Risk Assessment

Successful exploitation allows an attacker to execute commands with elevated privileges, potentially leading to full system compromise and network breach.

Recommendation

Immediately update the router firmware to the latest version provided by the vendor and restrict administrative interface access to trusted users only.

Other vulnerabilities in U-SPEED AC1200 Gigabit Wi-Fi Router

CVE-2026-36738Medium
The U-SPEED AC1200 Gigabit Wi-Fi Router (Model T18-21K) V1.0 has an Incorrect Access Control vulnerability. The device exposes a UART interface without authentication, authorization, or access control mechanisms. An attacker with physical access to the UART pins can connect and gain unrestricted access to device functionality.

Original NVD description (English source)

U-SPEED AC1200 Gigabit Wi-Fi Router (Model: T18-21K) V1.0 is vulnerable to Command Injection. The Network Time Protocol (NTP) configuration interface does not properly sanitize user-supplied input. An authenticated user with permission to configure NTP settings can inject arbitrary system commands through crafted input fields. These commands are executed with elevated privileges, leading to potential full system compromise.