VULNERABILITY INTELLIGENCE

CVE-2026-36741

CVSS score7.2 HIGH
EPSS probability2.09%
CISA KEVNot currently listed
Published2026-05-13
Last modified2026-06-30
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

U-SPEED AC1200 Gigabit Wi-Fi Router (Model: T18-21K) V1.0 is vulnerable to Command Injection. The Network Time Protocol (NTP) configuration interface does not properly sanitize user-supplied input. An authenticated user with permission to configure NTP settings can inject arbitrary system commands through crafted input fields. These commands are executed with elevated privileges, leading to potential full system compromise.

Weakness classification

  • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')

Primary references