Getting root on on TP-Link Smart Switches using CVE-2026-1668 - Part 2

In the previous post, I described the details of CVE-2026-1668, and how we’re able to obtain an out-of-bounds write by setting a specific value in the Content-Length header. In this post, we describe how we can use that achieve arbitrary code execution.