CVE-2026-36738

U-SPEED AC1200 Gigabit Wi-Fi Router (Model: T18-21K) V1.0 is vulnerable to Incorrect Access Control. The device exposes a UART interface that lacks authentication, authorization, or access control mechanisms. An attacker with physical access to the UART pins can connect to the interface and gain unrestricted access to device functionality.

CVSS v3 6.8 MEDIUM

6.8^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.9 / Impact : 5.9

Attack Vector PHYSICAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/N0tMilk/vulnerability-research	Third Party Advisory
https://github.com/N0tMilk/vulnerability-research/tree/main/IoT/CVE-2026-36738	Exploit Third Party Advisory
https://github.com/N0tMilk/vulnerability-research/tree/main/IoT/CVE-2026-36738	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:o:u-speed:t18-21k_firmware:1.0:*:*:*:*:*:*:*

cpe:2.3:h:u-speed:t18-21k:-:*:*:*:*:*:*:*

History

No history.

Information

Published : 2026-05-13 16:16

Updated : 2026-06-30 19:02

NVD link : CVE-2026-36738

Mitre link : CVE-2026-36738

CVE.ORG link : CVE-2026-36738

JSON object : View

Products Affected

u-speed

t18-21k_firmware
t18-21k

CWE

CWE-284

Improper Access Control

{"id": "CVE-2026-36738", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-36738", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-14T13:53:35.314691Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.8, "attackVector": "PHYSICAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}]}], "published": "2026-05-13T16:16:40.707", "references": [{"url": "https://github.com/N0tMilk/vulnerability-research", "tags": ["Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/N0tMilk/vulnerability-research/tree/main/IoT/CVE-2026-36738", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/N0tMilk/vulnerability-research/tree/main/IoT/CVE-2026-36738", "tags": ["Exploit", "Third Party Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "U-SPEED AC1200 Gigabit Wi-Fi Router (Model: T18-21K) V1.0 is vulnerable to Incorrect Access Control. The device exposes a UART interface that lacks authentication, authorization, or access control mechanisms. An attacker with physical access to the UART pins can connect to the interface and gain unrestricted access to device functionality."}], "lastModified": "2026-06-30T19:02:27.033", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:u-speed:t18-21k_firmware:1.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "86FD0F4B-75F7-44D6-B15E-A20E96FBAA5D"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:u-speed:t18-21k:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "DF8B48A7-E2DA-4BEB-A41D-8300A7A7AA23"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}