TP-Link HomeShield Function Vulnerability Let Attackers Inject Malicious Commands

**Executive summary:** A critical command-injection vulnerability (CVE-2024-53375) in TP-Link HomeShield firmware for Archer, Deco, and Tapo routers allows an authenticated attacker to supply an unsanitized ownerId to os.execute in avira.lua, enabling root remote code execution; researchers produced a proof-of-concept via firmware extraction/emulation and recommend applying vendor patches and input validation mitigations.