CVE-2026-36738 describes an incorrect access control vulnerability in the U-SPEED AC1200 Gigabit Wi-Fi Router (Model: T18-21K) V1.0. The device exposes a UART interface that lacks any authentication, authorization, or access control mechanisms. This allows an attacker with physical access to the UART pins to connect and gain unrestricted access to the router's functions. No CVSS score or patch information is provided, and no known exploits have been reported.

An attacker with physical access to the router can leverage the exposed UART interface to gain unrestricted access to device functionality. This could lead to full compromise of the device, including configuration changes, firmware modification, or other malicious activities. Remote attackers cannot exploit this vulnerability without physical access. No information on exploitation in the wild is available.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict physical access to the device to prevent unauthorized connection to the UART interface. Consider hardware-level protections or disabling the UART interface if possible.