The vulnerability lies in the NTP configuration interface of the U‑SPEED AC1200 router. Input fields used to set NTP parameters are not properly sanitized, permitting an authenticated user with configuration privileges to inject arbitrary commands. This is a CWE‑77 Command Injection vulnerability. These injected commands are executed with elevated privileges, enabling full system compromise. The impacted characteristic is the potential to run any command on the device, leading to loss of confidentiality, integrity, and availability of the router and any connected devices.

Affected systems include the U‑SPEED AC1200 Gigabit Wi‑Fi Router, Model T18‑21K, firmware V1.0. The information from the CVE lists only the vendor and model, with no specific version range beyond the identified firmware.

Risk assessment indicates that the flaw supports high‑impact exploitation. The CVSS score of 7.2, combined with an EPSS score of 0.00173 (less than 1 %), suggests moderate to high risk. Although the vulnerability is not listed in the CISA KEV catalog, the nature of the command injection (CWE‑77) and its privileged execution indicate a severe threat. The likely attack vector is a locally authenticated user or a remote entity that can gain authenticated access to the NTP configuration endpoint, as the description requires such permissions to inject commands.