I reported this to TP-Link today. Developers please remember to not pass unsanitized input from the internet to the command line It's scary how vulnerable these IOT devices are- especially the ones marketed as security orientated products