MeshyJSON: A TP-Link tdpServer JSON Stack Overflow

This NCC Group blog details a remote code execution vulnerability in TP‑Link Archer AX21's tdpServer (mesh TDP protocol) caused by an unchecked onemesh_support_version JSON array that overflows a fixed 32‑byte stack buffer; the write‑up explains two network flows to reach the vulnerable function, the heap spray and virtualized heap (VHeap) techniques used to bypass ASLR and craft deterministic cJSON allocations, a ROP-based payload to invoke system(), exploitation reliability constraints, and notes that TP‑Link patched the issue in firmware Archer AX21(US)_V3.6_1.1.3 Build 20221125.