CVE-2026-36741 describes a command injection vulnerability in the NTP configuration interface of the U-SPEED AC1200 Gigabit Wi-Fi Router (Model: T18-21K) V1.0. The interface fails to properly sanitize user-supplied input, enabling an authenticated user with configuration permissions to inject and execute arbitrary system commands with elevated privileges. This vulnerability is classified under CWE-77 and carries a CVSS v3.1 score of 7.2 (High), reflecting network attack vector, low attack complexity, required high privileges, no user interaction, and impacts on confidentiality, integrity, and availability. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation allows an authenticated user with NTP configuration permissions to execute arbitrary system commands with elevated privileges on the router. This can lead to full system compromise, including unauthorized control over the device, potential disruption of network services, and exposure of sensitive information. The high CVSS score reflects significant impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the router's NTP configuration interface to trusted administrators only. Monitor for unusual activity from authenticated users with configuration permissions. Avoid exposing the management interface to untrusted networks.