CVE-2022-37055criticalunder attackCWE-120

CVE-2022-37055

Published · Updated

Follow this CVE+ Monitor Routers

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

70Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 9.8epss 56%
from disclosure to weapon
Published on NVDAug 28
CISA KEV+1198d
Action required by CISAfederal deadline: 2025-12-29

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

The D-Link Go-RT-AC750 router has a critical flaw that allows attackers to overflow a memory buffer through the web interface, potentially taking complete control of the device without needing a password.

Technical detail

A buffer overflow vulnerability exists in the cgibin hnap_main handler affecting D-Link Go-RT-AC750 firmware versions revA_v101b03 and revB_FWv200b02. Remote unauthenticated attackers can exploit this via crafted HTTP requests to execute arbitrary code with device privileges, achieving complete system compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Buffer Overflow via cgibin, hnap_main,
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a