Donald Warren

**Name of the Vulnerable Software and Affected Versions** U-SPEED AC1200 Gigabit Wi-Fi Router (Model: T18-21K) version 1.0 **Description** The device is subject to incorrect access control because it exposes a UART (Universal Asynchronous Receiver-Transmitter, a hardware communication protocol) interface that lacks authentication, authorization, or access control mechanisms. An attacker with physical access to the UART pins can connect to this interface to gain unrestricted access to device functionality. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** U-SPEED AC1200 Gigabit Wi-Fi Router (Model: T18-21K) version 1.0 **Description** The Network Time Protocol (NTP) configuration interface fails to properly sanitize user-supplied input. An authenticated user with permissions to modify NTP settings can perform Command Injection—a flaw that allows the execution of arbitrary system commands—by providing crafted input. These commands run with elevated privileges, which can result in a full system compromise. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.