CVE-2022-37055

What it actually does

CVE-2022-37055 is a remotely exploitable buffer overflow in D-Link Go-RT-AC750 router firmware, affecting the cgibin/HNAP handling path, including the hnap_main component. Because the vulnerability is reachable over the network with no authentication, no user interaction, and low attack complexity, an attacker can send a crafted HTTP request that overflows memory in the router’s web-management service. Successful exploitation can allow arbitrary code execution with the privileges of the vulnerable service, device takeover, configuration modification, traffic interception, credential theft, or denial of service. The CVSS score is 9.8, and the EPSS score of 0.57037 indicates a materially elevated likelihood of exploitation compared with most vulnerabilities.

Why it matters to the business

Compromise of an affected edge router can give an attacker control over internet-facing network infrastructure, enabling outages, traffic redirection, credential harvesting, malware deployment, botnet enrollment, or use of the device as a foothold into internal networks. Because this issue is listed in CISA KEV, is marked as actively exploited in the wild, and has a CISA remediation due date of 2025-12-29, exposed devices should be treated as high-priority operational risk. The affected D-Link Go-RT-AC750 models are consumer/SOHO-class routers that may be present in small offices, branch locations, labs, home-office networks, or unmanaged network segments, making asset discovery especially important.

How an attack unfolds

An attacker scans the internet or local network for D-Link Go-RT-AC750 routers exposing the web administration interface or HNAP endpoint. After fingerprinting the device model or firmware version, the attacker sends a specially crafted unauthenticated HTTP request to the vulnerable cgibin/HNAP handler, commonly involving the hnap_main processing path. The malformed request causes a buffer overflow in the router process. If the attacker only corrupts memory, the router may crash or reboot; if exploitation is reliable, the attacker can redirect execution and run commands or implant malware on the device. After gaining control, the attacker may change DNS settings, open remote access, capture or redirect traffic, join the router to a botnet, pivot into connected networks, or remove artifacts. Public exploitation and KEV status mean defenders should assume internet-exposed vulnerable devices may already have been targeted.

How to fix it

Remove affected D-Link Go-RT-AC750 devices from internet exposure immediately. Because no fixed versions were provided for the affected firmware builds GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02, organizations should check D-Link advisories for any later supported firmware and upgrade if a vendor-supported fix exists. If no fixed firmware is available, replace the device with a supported router model. As mitigations until replacement, disable remote administration, block WAN access to the management interface, restrict administration to a trusted management network, disable HNAP if the firmware allows it, place the device behind a firewall or VPN, and use strong unique administrative credentials. For any device suspected of compromise, perform a factory reset, reconfigure from trusted settings rather than backups, rotate credentials and Wi-Fi keys, review DNS/firewall/port-forwarding settings, and replace the device if compromise cannot be ruled out.

How to confirm the fix worked

Confirm whether any D-Link Go-RT-AC750 devices are present through asset inventory, network scans, DHCP logs, ARP tables, wireless controller records, firewall logs, and vulnerability scanners. Validate exposure by checking whether the router management interface, /HNAP1/ endpoint, or cgibin paths are reachable from untrusted networks. Confirm firmware versions through the device web UI, administrative API, configuration exports, or authenticated scanner checks, and compare against the affected versions GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02. After remediation, verify that WAN-side access to management services is blocked, HNAP endpoints are not reachable from untrusted networks, router configuration has not been altered unexpectedly, and scans no longer identify the vulnerable model/firmware. If the device was replaced, confirm the old device is decommissioned and no longer appears in network telemetry.

Typical attack path

1. Scan for internet-facing or locally reachable D-Link Go-RT-AC750 devices and web administration interfaces.
2. Fingerprint the device using HTTP responses, HNAP behavior, banners, firmware identifiers, or login-page characteristics.
3. Send a crafted unauthenticated HTTP request to the vulnerable cgibin/HNAP endpoint, including malformed or oversized input handled by hnap_main.
4. Trigger memory corruption in the router’s web-management process.
5. Achieve denial of service through process crash or router reboot, or execute attacker-controlled code if exploitation succeeds.
6. Persist by modifying router configuration, enabling remote administration, changing DNS or firewall settings, deploying malware, or adding startup commands where possible.
7. Use the compromised router for traffic interception, botnet activity, scanning, proxying, credential theft, or pivoting toward connected systems.

How to detect it

Investigate web server, firewall, IDS/IPS, proxy, NetFlow, DNS, and router administrative logs for evidence of unauthenticated requests to HNAP or cgibin endpoints, especially POST requests with unusually long headers, long SOAPAction values, malformed XML/SOAP content, repeated crashes, or router reboots shortly after suspicious traffic. Look for scanning behavior against /HNAP1/ or management interfaces from unfamiliar external IPs. On the router, review configuration for unauthorized DNS servers, enabled remote administration, unexpected port forwards, changed firewall rules, unknown administrative users, altered Wi-Fi settings, or persistence/startup changes. Network telemetry may show compromised-device behavior such as outbound connections to unfamiliar hosts, high-volume scanning, brute-force attempts against other devices, proxy-like traffic, DNS queries to suspicious domains, or participation in botnet-style traffic. Because attacker tooling may vary and embedded device logging is often limited, absence of logs should not be treated as proof of non-exploitation; exposed vulnerable devices should be considered potentially targeted.

• POST /HNAP1/
• GET /HNAP1/
• /HNAP1/
• SOAPAction:
• hnap_main
• /cgibin
• GET /cgibin
• POST /cgibin
• GORTAC750_revA_v101b03
• GO-RT-AC750_revB_FWv200b02
• D-Link Go-RT-AC750

What your security team should do

• Immediately identify all D-Link Go-RT-AC750 routers, including branch, lab, guest, and home-office equipment that may not be in centralized inventory.
• Prioritize any internet-facing or untrusted-network-facing devices for isolation, replacement, or confirmed firmware remediation because the vulnerability is in CISA KEV and actively exploited in the wild.
• If no vendor-fixed firmware is available, replace affected devices rather than relying on compensating controls long term.
• Block inbound access from the internet to router administration services, HNAP endpoints, and cgibin paths at upstream firewalls where possible.
• Review router configurations for suspicious changes, including DNS servers, port forwards, firewall rules, remote-management settings, admin accounts, and startup/persistence mechanisms.
• Factory reset and reconfigure any exposed vulnerable device, rotate administrative credentials and Wi-Fi keys, and consider replacing the device if compromise is suspected.
• Add detections for probing or exploitation attempts against /HNAP1/, cgibin, and hnap_main-related paths, especially oversized HTTP headers or payloads.
• Monitor for router instability, unexpected reboots, unusual outbound connections, scanning behavior, or traffic to known botnet infrastructure.
• Use the CISA KEV due date of 2025-12-29 as the latest acceptable remediation deadline, but remediate exposed devices much sooner due to active exploitation and high exploit likelihood.