PT-2026-40706 · U Speed · T18-21K Firmware

Donald Warren · CVE-2026-36741 · Published 2026-05-13 · Updated 2026-06-30

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions U-SPEED AC1200 Gigabit Wi-Fi Router (Model: T18-21K) version 1.0

Description The Network Time Protocol (NTP) configuration interface fails to properly sanitize user-supplied input. An authenticated user with permissions to modify NTP settings can perform Command Injection—a flaw that allows the execution of arbitrary system commands—by providing crafted input. These commands run with elevated privileges, which can result in a full system compromise.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2026-36741

Affected Products

T18-21K Firmware

References · 4

• 🔥 https://github.com/N0tMilk/vulnerability-research/tree/main/IoT/CVE-2026-36741 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-36741 · Security Note
• https://t.me/cveNotify/181253 · Telegram Post
• https://github.com/N0tMilk/vulnerability-research · Note