Finding a RCE in my old TP-Link router

Finding a RCE in my old TP-Link router I was eating lunch one day in late December (2025), and was reading an article by Simone Margaritelli about several TP-Link vulnerabilities he found in his IP Camera. After finishing both the article and my toast, I realised two things:
I had my own TP-Link router collecting dust in a cupboard. The firmware blobs for it were stored on an open S3 bucket, which would make it incredibly easy to reverse engineer.