The TP-Link Archer C5400X gaming router contains a critical security vulnerability that allows unauthenticated, remote attackers to execute commands on the device, leading to potential hijacking, data interception, and internal network breaches. This flaw, tracked as CVE-2024-5035, with a CVSS score of 10/10, affects all firmware versions up to and including 1_1.1.6. The flaw was identified by researchers from OneKey through binary static analysis of the “rftest” binary, which exposes a network service on TCP ports 8888, 8889, and 8890. Exploiting this flaw with shell metacharacters can achieve arbitrary command execution with elevated privileges. TP-Link released a patch on May 24, 2024, in firmware version 1_1.1.7, which filters out commands containing these special characters. CTIX analysts strongly advise users to update their firmware to secure their routers from future exploitation.