Cyber Resilience

CVE-2026-36741

HighRCE

Published: 13 May 2026

Published
13 May 2026
Modified
14 May 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0028 51.9th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-36741 is a high-severity Command Injection (CWE-77) vulnerability. Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Unix Shell (T1059.004); ranked in the top 48.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

U-SPEED AC1200 Gigabit Wi-Fi Router (Model: T18-21K) V1.0 is vulnerable to Command Injection. The Network Time Protocol (NTP) configuration interface does not properly sanitize user-supplied input. An authenticated user with permission to configure NTP settings can inject arbitrary system commands…

more

through crafted input fields. These commands are executed with elevated privileges, leading to potential full system compromise.

CWE(s)
CWE-77

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
Why these techniques?

Command injection in NTP config allows direct arbitrary Unix shell command execution with elevated privileges on network device.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-30898Shared CWE-77
CVE-2024-53412Shared CWE-77
CVE-2026-3517Shared CWE-77
CVE-2025-33181Shared CWE-77
CVE-2025-26331Shared CWE-77
CVE-2026-8632Shared CWE-77
CVE-2025-22473Shared CWE-77
CVE-2025-33180Shared CWE-77
CVE-2026-40061Shared CWE-77
CVE-2025-22472Shared CWE-77

Affected Assets

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References