Deco M4 firmware versions prior to 'Deco M4(JP)_V2_1.5.8 Build 20230619' allows a network-adjacent authenticated malicious user to execute arbitrary OS commands.
tp-link deco_m4_firmware