• CISA flags security issue affecting multiple TP-Link models
• It allows threat actors to execute arbitrary system-level commands
• Affected models have all reached end of life, so should be replaced anyway

Multiple TP-Link routers, which have long reached end-of-life (EoL) status, are being abused in real-life attacks, the US government is warning.

The US Cybersecurity and Infrastructure Security Agency (CISA) has added a command injection vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, signaling abuse in the wild.