Google security developer Matthew Garrett disclosed a zero-day arbitrary code execution (ACE) vulnerability affecting the TP-Link SR20 routers.

https://securityaffairs.co/wordpress/83031/breaking-news/tp-link-sr20-router-ace.html