Getting root on on TP-Link Smart Switches using CVE-2026-1668 - Part 3
In the previous post, I described how we can exploit CVE-2026-1668 to gain arbitrary code execution. In this post, I go into the details of building a useful exploit payload.
tangrs
Latest posts
Getting root on on TP-Link Smart Switches using CVE-2026-1668 - Part 2
In the previous post, I described the details of CVE-2026-1668, and how we’re able to obtain an out-of-bounds write by setting a specific value in the Content-Length header. In this post, we describe how we can use that achieve arbitrary code execution.
Getting root on on TP-Link Smart Switches using CVE-2026-1668 - Part 1
In late 2025, I discovered a vulnerability in some TP-Link Smart Switches that could be exploited to obtain unauthenticated remote code execution as root (CVE-2026-1668).
Low-trust ZFS Replication on TrueNAS
TrueNAS’s snapshot replication functionality is useful for implementing off-site backups. I currently use this functionality to perform a two-way cross-backup of two TrueNAS installations. Unfortunately, the current version of TrueNAS doesn’t seem to provide many options for building strong protections against local compromise (e.g. ransomware attacks that target TrueNAS) having the ability to…
Verifying TP-Link Smart Switch Firmware Signatures
In a previous post, I described the firmware encryption for some TP-Link Smart Switches. At the end of the post, I alluded to the fact that TP-Link does sign and verify firmware signatures, but did not dig deeper at the time.
Reverse engineering PoE on the TL-SG2008P V3 firmware - Part 2
In my previous post, I wrote about how I obtained root on the stock firmware of my switch to try to figure out how the stock firmware was implementing per-port power limits. The next step was to actually perform the introspection into what the stock firmware was doing.
Reverse engineering PoE on the TL-SG2008P V3 firmware - Part 1
Background
Decrypting TP-Link Smart Switch firmware
I recently acquired a TL-SG2008P and was hoping to do some research on the stock firmware for various reasons (mostly curiosity). Unfortunately, the firmware images made available by TP-Link on their website seemed to be encrypted, so it wasn’t a trivial matter of running binwalk on the image.
Basic fan control for the Asustor Lockerstor Gen2 in TrueNAS
With the warmer months coming up, I started to worry about the low fixed speed of the built-in fan of my Asustor Lockerstor Gen2 NAS running TrueNAS. When using the default Asustor software, there’s a userspace daemon that presumably monitors temperatures of the CPU and drives and adjusts the fan speed accordingly. However, there is no such fan control mechanism by default in TrueNAS.
Basic TrueNAS support for the display and status LED on the Asustor Lockerstor Gen2
I recently bought a Asustor Lockerstor 4 Gen2 NAS to run TrueNAS on. Asustor has endorsed installing third-party operating systems, and I had no problems disabling the stock operating system and running TrueNAS instead.