CVE-2026-36741

U-SPEED AC1200 Gigabit Wi-Fi Router (Model: T18-21K) V1.0 is vulnerable to Command Injection. The Network Time Protocol (NTP) configuration interface does not properly sanitize user-supplied input. An authenticated user with permission to configure NTP settings can inject arbitrary system commands through crafted input fields. These commands are executed with elevated privileges, leading to potential full system compromise.

• CWE-77

• https://github.com/N0tMilk/vulnerability-researchThird Party Advisory
• https://github.com/N0tMilk/vulnerability-research/tree/main/IoT/CVE-2026-36741Exploit, Third Party Advisory
• https://github.com/N0tMilk/vulnerability-research/tree/main/IoT/CVE-2026-36741Exploit, Third Party Advisory

Published

May 13, 2026

Last Modified

Jun 30, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-36727An insecure authentication vulnerability in the /api/social-…9.1
• CVE-2026-36728A markdown based cross-site scripting (XSS) vulnerability in…5.4
• CVE-2026-3673An authenticated attacker can store a crafted tag value in _…5.4
• CVE-2026-36734EDIMAX BR-6428nS V3 1.15 is vulnerable to Command Injection.…8.8
• CVE-2026-36738U-SPEED AC1200 Gigabit Wi-Fi Router (Model: T18-21K) V1.0 is…6.8
• CVE-2026-3674A vulnerability was found in Freedom Factory dGEN1 up to 202…5.3
• CVE-2026-36742Hiseeu C90 v5.7.15 is vulnerable to Insecure Permissions. Th…6.8
• CVE-2026-36748RockRMS v16.13 and before v.17.7.0 is vulnerable to Cross Si…9
• CVE-2026-3675A vulnerability was determined in Freedom Factory dGEN1 up t…5.3
• CVE-2026-36756A Server-Side Request Forgery (SSRF) in the /plugins/-/insta…5.4
• CVE-2026-36757A Server-Side Request Forgery (SSRF) in the /plugins/{name}/…4.3
• CVE-2026-36758A Server-Side Request Forgery (SSRF) in the /themes/-/instal…4.3