cbcvebase.
CVE-2022-37055
published 2022-08-28

CVE-2022-37055: D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Buffer Overflow via cgibin, hnap_main,

PriorityP185critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2025-12-29
Exploited in the wild
EPSS
57.04%
99.0th percentile
D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Buffer Overflow via cgibin, hnap_main,

Affected

2 ranges
VendorProductVersion rangeFixed in
dlinkgo-rt-ac750_firmware
dlinkgo-rt-ac750_firmware

Detection & IOCsextracted from sources · hover to see the quote

url/hnap1/
snort
alert http any any -> any any (msg:"ET WEB_SPECIFIC_APPS D-Link HNAP1 GetDeviceSettings Buffer Overflow Attempt (2022-37055)"; flow:established,to_server; http.uri; content:"/hnap1/"; nocase; http.header; content:"soapaction|3a 20|"; nocase; content:"http|3a 2f 2f|purenetworks|2e|com|2f|hnap1|2f|getdevicesettings"; within:60; fast_pattern; nocase; pcre:"/^[^&]{100,}(?:&|$)/R"; reference:cve,2022-37055; classtype:web-application-attack; sid:2066178; rev:1; metadata:affected_product D_Link, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_12_08, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_12_08, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)
  • Exploit targets the HNAP1 endpoint via HTTP POST; look for requests to URI /hnap1/ with a SOAPAction header containing the GetDeviceSettings action string pointing to purenetworks.com/HNAP1/GetDeviceSettings
  • Buffer overflow is triggered by an abnormally long parameter value (>=100 chars before an '&' or end of string) in the HNAP1 request body; the PCRE /^[^&]{100,}(?:&|$)/R matches this condition
  • The vulnerable code path is in the cgibin binary, specifically the hnap_main function; focus monitoring on HTTP traffic to the router's HNAP1 interface in plaintext (non-TLS) sessions
  • Deploy the Emerging Threats rule SID 2066178 at perimeter and internal network chokepoints to detect exploitation attempts; rule is classified as high-confidence, major severity
  • ·Affected devices (D-Link Go-RT-AC750 revA and revB) are likely end-of-life/end-of-service; no patch may be available — detection is the primary mitigation alongside device decommissioning

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.