CVE-2026-36741: U-SPEED AC1200 Router RCE Vulnerability

CVE-2026-36741 Overview

CVE-2026-36741 is a command injection vulnerability affecting the U-SPEED AC1200 Gigabit Wi-Fi Router, model T18-21K V1.0. The flaw resides in the Network Time Protocol (NTP) configuration interface, which fails to sanitize user-supplied input. An authenticated attacker with permission to modify NTP settings can inject arbitrary operating system commands through crafted input fields. The injected commands execute with elevated privileges on the device, enabling full system compromise. The vulnerability is classified under [CWE-77] (Improper Neutralization of Special Elements used in a Command).

Critical Impact
Authenticated attackers can execute arbitrary commands with elevated privileges on the router, leading to full device takeover and pivoting into the connected network.

Affected Products

U-SPEED AC1200 Gigabit Wi-Fi Router
Model: T18-21K
Firmware version: V1.0

Discovery Timeline

2026-05-13 - CVE-2026-36741 published to NVD
2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-36741

Vulnerability Analysis

The vulnerability resides in the router's web-based administration interface, specifically the NTP configuration handler. The interface accepts user-supplied parameters intended to define NTP server addresses or related scheduling fields. These parameters are passed to an underlying shell command without sanitization or argument quoting. As a result, shell metacharacters such as ;, |, &&, and backticks are interpreted by the system shell rather than treated as literal data.

Exploitation requires authenticated access to the administrative interface with privileges to modify NTP settings. The injected commands run in the context of the process handling NTP configuration, which on consumer IoT routers typically executes as root. Successful exploitation grants attackers the ability to read configuration files, modify firmware, deploy persistent implants, and intercept or redirect traffic traversing the device.

Root Cause

The root cause is improper neutralization of special elements in commands constructed from user input [CWE-77]. The NTP configuration endpoint concatenates input into a shell command string and invokes a system shell rather than using parameterized execution APIs such as execve with a fixed argument list.

Attack Vector

The attack vector is network-based. An attacker with valid administrative credentials, or one who has gained credentials through phishing, default-credential reuse, or session theft, sends a crafted HTTP request to the NTP configuration endpoint. The payload embeds shell metacharacters within an NTP-related field. The router processes the request and the injected commands run with elevated privileges. The vulnerability cannot be exploited by unauthenticated attackers, but the high-privilege execution context amplifies the impact once authentication is bypassed or obtained.

No verified public proof-of-concept code is currently available. See the GitHub CVE-2026-36741 Resource for additional technical details published by the reporter.

Detection Methods for CVE-2026-36741

Indicators of Compromise

Unexpected outbound connections from the router to attacker-controlled infrastructure, indicating a reverse shell or beacon spawned by injected commands.
NTP configuration entries containing shell metacharacters such as ;, |, &, $(), or backticks.
Modified or unfamiliar processes running on the router, particularly any processes spawned as children of the NTP or configuration daemons.
Unauthorized firmware modifications, new cron entries, or unexpected files in writable filesystem paths.

Detection Strategies

Inspect HTTP request logs on the router or upstream proxies for POST or GET requests to NTP configuration endpoints containing shell metacharacters.
Monitor administrative authentication events to the router and correlate successful logins with subsequent configuration changes.
Capture and review router configuration backups for anomalous NTP server values that include command separators or substitution syntax.

Monitoring Recommendations

Forward router syslog and authentication events to a centralized logging platform for correlation and retention.
Enable network flow monitoring to identify atypical outbound traffic from the router itself, which under normal conditions should be minimal.
Establish a baseline of administrative interface usage and alert on configuration changes occurring outside of expected maintenance windows.

How to Mitigate CVE-2026-36741

Immediate Actions Required

Restrict access to the router's administrative interface to trusted management networks only and disable remote WAN-side administration.
Rotate administrative credentials and enforce strong, unique passwords to reduce the likelihood that an attacker obtains the authenticated access required for exploitation.
Audit existing NTP configuration values on affected devices and reset them to known-good defaults if any suspicious characters are present.
Monitor the vendor's support channels for a firmware update addressing CVE-2026-36741.

Patch Information

No vendor patch or firmware update has been published in the referenced advisories at the time of NVD publication. Refer to the GitHub Vulnerability Research Repository and the GitHub CVE-2026-36741 Resource for current technical information. Apply vendor firmware updates as soon as they become available.

Workarounds

Limit administrative access to the router using network segmentation, ACLs, or a dedicated management VLAN.
Disable the web administration interface on the WAN interface and require local network access for configuration changes.
Avoid configuring NTP settings through accounts that may be shared or used for non-administrative tasks, and review administrator account permissions.
Replace the device with a supported model if no patch is forthcoming and the router is deployed in a sensitive environment.

bash

# Configuration example: restrict router admin interface to a management subnet
# (example iptables rules applied on an upstream firewall)
iptables -A FORWARD -s 192.0.2.0/24 -d <router_ip> -p tcp --dport 80 -j ACCEPT
iptables -A FORWARD -s 192.0.2.0/24 -d <router_ip> -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d <router_ip> -p tcp --dport 80 -j DROP
iptables -A FORWARD -d <router_ip> -p tcp --dport 443 -j DROP