CVE-2022-37055
D-Link Routers Buffer Overflow Vulnerability
Description
CVE-2022-37055 is a critical buffer overflow vulnerability in the D-Link Go-RT-AC750 router affecting both hardware revisions A (firmware v101b03) and B (firmware v200b02). With a CVSS v3.1 base score of 9.8, this vulnerability exists in the cgibin and hnap_main components and allows an unauthenticated remote attacker to execute arbitrary code on the affected device. The flaw is trivially exploitable over the network with no authentication or user interaction required. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of December 29, 2025, and carries an exceptionally high EPSS score of 0.69755 (98.6th percentile), indicating widespread active exploitation, likely by botnet operators targeting consumer and small business routers.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| dlink | go-rt-ac750 firmware | 2.00b02; 1.01b03 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://drive.google.com/file/d/1hmIk0jQoex4QDyjIUg_6yxi-J6ROCh8S/view?usp=sharing(Exploit, Patch, Third Party Advisory)
- https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10308(Vendor Advisory)
- https://www.dlink.com/en/security-bulletin/(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-37055(US Government Resource)
- https://www.fortiguard.com/outbreak-alert/d-link-multiple-devices-attack(Third Party Advisory)
Weakness Type
CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CVE-2022-37055 is classified under CWE-120, which describes the classic buffer overflow condition where data is copied into a fixed-size buffer without verifying that the input data fits within the buffer boundaries. In the case of the D-Link Go-RT-AC750, the cgibin and hnap_main components handle HTTP requests from the network and copy input data into stack or heap buffers without proper bounds checking. When an attacker sends input larger than the allocated buffer, the excess data overwrites adjacent memory, potentially including return addresses, function pointers, or other critical control data. On embedded devices running MIPS or ARM architectures without modern memory protections, buffer overflow exploitation is particularly reliable and well-understood. Learn more about CWE-120
Impact Analysis
Confidentiality, Integrity, and Availability are all rated as high impact (C:H/I:H/A:H). Successful exploitation gives the attacker complete control over the router, allowing them to intercept all network traffic passing through the device, modify DNS settings to redirect traffic to malicious servers, install persistent malware or backdoors in the router's firmware, and use the compromised device as a node in a botnet.
Business Impact extends beyond the device itself. Consumer and small business routers act as the network gateway for all connected devices. Compromise of the router enables man-in-the-middle attacks against all connected clients, DNS hijacking to redirect users to phishing or malware distribution sites, and use of the router's internet connection for attack traffic. For small businesses, a compromised router can lead to theft of customer payment data, business email compromise, and regulatory violations.
Exploitation Probability is extremely high. The EPSS score of 0.69755 (98.6th percentile) indicates that this vulnerability is among the most heavily exploited CVEs currently tracked. D-Link router vulnerabilities are consistently targeted by IoT botnets such as Mirai variants, which scan the internet for vulnerable devices and automatically compromise them. Fortinet has documented this vulnerability as part of a multi-device attack campaign. The ransomware association is listed as "Unknown" by CISA, but compromised routers can facilitate ransomware delivery by intercepting and modifying network traffic.
Exploit Maturity
CVE-2022-37055 has confirmed, widespread active exploitation. CISA has added it to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of December 29, 2025. The EPSS score of 0.69755 (98.6th percentile) places it among the most heavily exploited vulnerabilities tracked, indicating mass automated exploitation.
Public exploit information is available, and Fortinet has documented this vulnerability as part of a multi-device attack campaign targeting D-Link products. The vulnerability requires no authentication (PR:N), no user interaction (UI:N), and has low attack complexity (AC:L), making it ideal for automated exploitation by botnet operators. IoT botnets routinely scan the entire IPv4 address space for vulnerable router management interfaces and exploit them within minutes of new exploit code becoming available. The D-Link Go-RT-AC750 is a consumer-grade router, and many deployments are unlikely to ever receive firmware updates, providing a persistent pool of vulnerable devices. The ransomware association is listed as "Unknown" by CISA, though compromised routers are increasingly used as infrastructure for broader attack campaigns.
Remediation
-
Apply D-Link Firmware Updates — Check for available firmware updates for the D-Link Go-RT-AC750 through the D-Link support and security bulletin page. Install the latest available firmware for your hardware revision (Rev A or Rev B). If no patched firmware is available and the device has reached end of life, proceed to step 5.
-
Disable Remote Management — If the router's web management interface is accessible from the WAN (internet-facing) side, immediately disable remote management access. Restrict management access to the local LAN only, which significantly reduces the attack surface for this vulnerability.
-
Change Default Administrative Credentials — While CVE-2022-37055 does not require authentication to exploit, changing default router credentials prevents attackers from accessing the management interface through other means and limits post-exploitation persistence options.
-
Monitor Network Traffic for Botnet Activity — Watch for unusual outbound connections from the router to known command-and-control servers, unexpected DNS query patterns, and high volumes of outbound scanning traffic on common IoT exploitation ports. These may indicate that the router has already been compromised and enrolled in a botnet.
-
Replace End-of-Life Devices — If the D-Link Go-RT-AC750 has reached end-of-life and no patched firmware is available, replace the device with a currently supported router model that receives regular security updates. End-of-life network equipment poses an ongoing security risk that cannot be mitigated through configuration changes alone.
Technical Details
CVE-2022-37055 is a classic buffer overflow vulnerability in the cgibin and hnap_main components of the D-Link Go-RT-AC750 router firmware. These components handle HTTP requests for the router's web management interface and the Home Network Administration Protocol (HNAP), respectively.
CVSS Vector Breakdown: The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H vector indicates near-maximum severity. Attack Vector (AV:N) means the vulnerability is exploitable remotely over the network. Attack Complexity (AC:L) indicates no special conditions are required. Privileges Required (PR:N) confirms no authentication is needed. User Interaction (UI:N) means no legitimate user action is required. Scope (S:U) is unchanged. Confidentiality, Integrity, and Availability (C:H/I:H/A:H) are all maximally impacted.
Attack Mechanism: The attacker sends a specially crafted HTTP request to the cgibin or hnap_main endpoint on the router's management interface. The request contains input data that exceeds the size of the buffer allocated to store it. Because the firmware does not check the size of the input before copying it into the buffer, the excess data overflows into adjacent memory regions. On the MIPS-based architecture used by the D-Link Go-RT-AC750, the attacker can overwrite the return address on the stack or corrupt function pointers to redirect program execution to attacker-supplied shellcode. The router's embedded Linux operating system typically lacks modern exploit mitigations such as ASLR, stack canaries, and DEP/NX, making exploitation highly reliable. Both hardware revision A (firmware GORTAC750_revA_v101b03) and revision B (firmware GO-RT-AC750_revB_FWv200b02) are confirmed vulnerable.
Frequently Asked Questions
Is the D-Link Go-RT-AC750 still supported with firmware updates?
D-Link has issued security bulletins for this vulnerability. However, given the age of the product, it may be approaching or have reached end-of-life status. Check D-Link's support page for your specific hardware revision to determine whether patched firmware is available. If the device is end-of-life, replacement with a supported model is recommended.
Can CVE-2022-37055 be exploited from the internet?
Yes, if the router's management interface or HNAP endpoint is accessible from the WAN side. Many consumer routers have remote management disabled by default, but some configurations or ISP deployments may expose these interfaces. Even with remote management disabled, attackers on the local network can exploit the vulnerability.
Why is the EPSS score so high for CVE-2022-37055?
The EPSS score of 0.69755 (98.6th percentile) reflects the widespread automated exploitation of this vulnerability by IoT botnets. Consumer routers are prime targets for botnets because they are always online, rarely updated, and provide network access that can be leveraged for DDoS attacks, cryptocurrency mining, and traffic proxying.
What are the signs that my router has been compromised?
Signs of compromise include unexpected changes to DNS settings, unusually slow internet performance, unexplained outbound traffic (especially on uncommon ports), modified firmware or configuration that resets after reboot, and the router communicating with unknown external IP addresses. If compromise is suspected, perform a factory reset and update to the latest firmware.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.