CVE-2022-37055
published 2022-08-28CVE-2022-37055: D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Buffer Overflow via cgibin, hnap_main,
PriorityP185critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
KEVITW
CISA Known Exploited Vulnerabilitydue 2025-12-29
Exploited in the wild
EPSS
57.04%
99.0th percentile
D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Buffer Overflow via cgibin, hnap_main,
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| dlink | go-rt-ac750_firmware | — | — |
| dlink | go-rt-ac750_firmware | — | — |
Detection & IOCsextracted from sources · hover to see the quote
url/hnap1/
snort
alert http any any -> any any (msg:"ET WEB_SPECIFIC_APPS D-Link HNAP1 GetDeviceSettings Buffer Overflow Attempt (2022-37055)"; flow:established,to_server; http.uri; content:"/hnap1/"; nocase; http.header; content:"soapaction|3a 20|"; nocase; content:"http|3a 2f 2f|purenetworks|2e|com|2f|hnap1|2f|getdevicesettings"; within:60; fast_pattern; nocase; pcre:"/^[^&]{100,}(?:&|$)/R"; reference:cve,2022-37055; classtype:web-application-attack; sid:2066178; rev:1; metadata:affected_product D_Link, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_12_08, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag CISA_KEV, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2025_12_08, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)- →Exploit targets the HNAP1 endpoint via HTTP POST; look for requests to URI /hnap1/ with a SOAPAction header containing the GetDeviceSettings action string pointing to purenetworks.com/HNAP1/GetDeviceSettings
- →Buffer overflow is triggered by an abnormally long parameter value (>=100 chars before an '&' or end of string) in the HNAP1 request body; the PCRE /^[^&]{100,}(?:&|$)/R matches this condition
- →The vulnerable code path is in the cgibin binary, specifically the hnap_main function; focus monitoring on HTTP traffic to the router's HNAP1 interface in plaintext (non-TLS) sessions ↗
- →Deploy the Emerging Threats rule SID 2066178 at perimeter and internal network chokepoints to detect exploitation attempts; rule is classified as high-confidence, major severity
- ·Affected devices (D-Link Go-RT-AC750 revA and revB) are likely end-of-life/end-of-service; no patch may be available — detection is the primary mitigation alongside device decommissioning ↗
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
cisa9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-45v7-mh84-5f9p: D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Buffer Overflow via cgibin, hnap_main,
ghsa_unreviewed·2022-08-29
CVE-2022-37055 [CRITICAL] CWE-120 GHSA-45v7-mh84-5f9p: D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Buffer Overflow via cgibin, hnap_main,
D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Buffer Overflow via cgibin, hnap_main,
VulnCheck
D-Link Routers Buffer Overflow Vulnerability
vulncheck·2022·CVSS 9.8
CVE-2022-37055 [CRITICAL] CWE-120 D-Link Routers Buffer Overflow Vulnerability
D-Link Routers Buffer Overflow Vulnerability
D-Link Routers contains a buffer overflow vulnerability that has a high impact on confidentiality, integrity, and availability. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Affected: D-Link Routers
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Exploitation References: https://www.fortiguard.com/outbreak-alert/d-link-multiple-devices-attack; https://www.fortinet.com/blog/threat-research/shadowv2-casts-a-shadow-over-iot-devices; https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json; https://www.recorde
CISA
D-Link Routers Buffer Overflow Vulnerability
cisa·2025-12-08·CVSS 9.8
CVE-2022-37055 [CRITICAL] CWE-120 D-Link Routers Buffer Overflow Vulnerability
Vulnerability: D-Link Routers Buffer Overflow Vulnerability
Affected: D-Link Routers
D-Link Routers contains a buffer overflow vulnerability that has a high impact on confidentiality, integrity, and availability. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Notes: https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10308 ; https://nvd.nist.gov/vuln/detail/CVE-2022-37055
Remediation Due Date: 2025-12-29
Suricata
ET WEB_SPECIFIC_APPS D-Link HNAP1 GetDeviceSettings Buffer Overflow Attempt (2022-37055)
suricata·2025-12-08
CVE-2022-37055 ET WEB_SPECIFIC_APPS D-Link HNAP1 GetDeviceSettings Buffer Overflow Attempt (2022-37055)
ET WEB_SPECIFIC_APPS D-Link HNAP1 GetDeviceSettings Buffer Overflow Attempt (2022-37055)
Rule: alert http any any -> any any (msg:"ET WEB_SPECIFIC_APPS D-Link HNAP1 GetDeviceSettings Buffer Overflow Attempt (2022-37055)"; flow:established,to_server; http.uri; content:"/hnap1/"; nocase; http.header; content:"soapaction|3a 20|"; nocase; content:"http|3a 2f 2f|purenetworks|2e|com|2f|hnap1|2f|getdevicesettings"; within:60; fast_pattern; nocase; pcre:"/^[^&]{100,}(?:&|$)/R"; reference:cve,2022-37055; classtype:web-application-attack; sid:2066178; rev:1; metadata:affected_product D_Link, attack_target Networking_Equipment, tls_state plaintext, created_at 2025_12_08, deployment Perimeter, deployment Internal, performance_impact Low, confidence High, signature_severity Major, tag Exploit, tag CIS
No public exploits indexed.
Fortinet
ShadowV2 Casts a Shadow Over IoT Devices | FortiGuard Lab
blogs_fortinet·2025-11-26
ShadowV2 Casts a Shadow Over IoT Devices | FortiGuard Lab
FORTIGUARD LABS THREAT RESEARCH
ShadowV2 Casts a Shadow Over IoT Devices | FortiGuard Lab
Inside the Latest Mirai Variant Targeting IoT Devices Worldwide
FORTIGUARD SECURITY PORTFOLIO 2025 THREAT LANDSCAPE REPORT
Incidents
Malware Analysis
Conclusion
Fortinet Protections
IOCs
Hosts
Files
By Vincent Li | November 26, 2025
Affected Platforms: DD-WRT 24 sp1, D-Link DNS-320 FW v2.06B01 Revision Ax, D-Link Go-RT-AC750 GORTAC750_revA_v101b03, D-Link GO-RT-AC750_revB_FWv200b02, Digiever DS-2105 Pro 3.1.0.71-11, TBK DVR-4104, TBK DVR-4216, D-Link DNS-320, D-Link DNS-320LW, D-Link DNS-325, D-Link DNS-340L, TP-Link Archer router series
Impacted Users: Any organization
Impact: Remote attackers gain control of the vulnerable systems
Severity Level: High
At the end of October, during a global disr
Bleepingcomputer
New ShadowV2 botnet malware used AWS outage as a test opportunity
blogs_bleepingcomputer·2025-11-26·CVSS 8.3
[HIGH] New ShadowV2 botnet malware used AWS outage as a test opportunity
## New ShadowV2 botnet malware used AWS outage as a test opportunity
## Bill Toulas
A new Mirai-based botnet malware named ‘ShadowV2’ has been observed targeting IoT devices from D-Link, TP-Link, and other vendors with exploits for known vulnerabilities.
Fortinet’s FortiGuard Labs researchers spotted the activity during the major AWS outage in October . Although the two incidents are not connected, the botnet was active only for the duration of the outage, which may indicate that it was a test run.
ShadowV2 spread by leveraging at least eight vulnerabilities in multiple IoT products:
DD-WRT (CVE-2009-2765)
D-Link (CVE-2020-25506, CVE-2022-37055, CVE-2024-10914, CVE-2024-10915)
DigiEver (CVE-2023-52163)
TBK (CVE-2024-3721)
TP-Link (CVE-2024-53375)
Among these flaws, CVE-2024-10914
Recorded Future
December 2025 CVE Landscape: 22 Critical Vulnerabilities Mark 120% Surge, React2Shell Dominates Threat Activity
blogs_recorded_future·CVSS 7.8
CVE-2025-55182 [HIGH] December 2025 CVE Landscape: 22 Critical Vulnerabilities Mark 120% Surge, React2Shell Dominates Threat Activity
# December 2025 CVE Landscape: 22 Critical Vulnerabilities Mark 120% Surge, React2Shell Dominates Threat Activity
December 2025 witnessed a dramatic 120% increase in high-impact vulnerabilities, with Recorded Future's Insikt Group® identifying 22 vulnerabilities requiring immediate remediation, up from 10 in November. The month was dominated by widespread exploitation of Meta's React Server Components flaw.
What security teams need to know:
- React2Shell pandemonium: CVE-2025-55182 triggered a global exploitation wave with multiple threat actors deploying diverse malware families
- China-nexus exploitation intensifies: Earth Lamia, Jackpot Panda, and UAT-9686 leveraged critical flaws for espionage operations
- Public exploits proliferate: Eleven of 22 vulnerabilities have proof-of-conce
Greynoiseio
NoiseLetter December 2025
blogs_greynoiseio·CVSS 10.0
[CRITICAL] NoiseLetter December 2025
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
https://drive.google.com/file/d/1hmIk0jQoex4QDyjIUg_6yxi-J6ROCh8S/view?usp=sharinghttps://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10308https://www.dlink.com/en/security-bulletin/https://drive.google.com/file/d/1hmIk0jQoex4QDyjIUg_6yxi-J6ROCh8S/view?usp=sharinghttps://www.dlink.com/en/security-bulletin/https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-37055https://www.fortiguard.com/outbreak-alert/d-link-multiple-devices-attack
2022-08-28
Published
2025-12-08
Added to CISA KEV
Exploited in the wild