D-Link GO-RT-AC750 Router cgibin Buffer Overflow Remote Code Execution Vulnerability (CVE-2022-37055) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTD-Link GO-RT-AC750 hardware revA (firmware v101b03 and prior) and revB (firmware FWv200b02 and prior).
Unauthenticated remote attackers can execute arbitrary code with root privileges or cause a complete system compromise by sending crafted HTTP requests to the WAN/LAN interface.
Apply the latest firmware updates immediately, or replace end-of-life (EoL) devices and disable remote WAN management interfaces.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Users must download and apply the appropriate firmware update corresponding to their hardware revision (A or B) from the official D-Link support portal.
# Download the official security advisory and firmware patch
curl -o firmware_update.bin 'https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10308'
# Apply the firmware manually via the router's Web GUI administration panel.2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, disable remote management (WAN access) and restrict access to the HNAP service to trusted internal IP addresses only.
# Block external WAN access to HTTP/HTTPS and HNAP ports using iptables
iptables -A INPUT -i eth0 -p tcp --dport 80 -j DROP
iptables -A INPUT -i eth0 -p tcp --dport 443 -j DROP
iptables -A INPUT -i eth0 -p tcp --dport 8080 -j DROP3. Log Audit & IoC Verification Commands
Inspect the router's web server logs for unusually long URI requests or payloads targeting cgibin or hnap_main.
# Scan web server access logs for potential buffer overflow exploitation attempts
grep -E 'cgibin|hnap_main' /var/log/httpd_access.log | awk '{if (length($0) > 512) print "[ALERT] Potential Exploit Attempt: " $0}'Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2022-37055) is a critical stack-based buffer overflow (CWE-120) residing within the hnap_main function of the cgibin binary, which handles web management interface requests on D-Link GO-RT-AC750 routers. The root cause is the lack of proper boundary and length validation on user-supplied input before copying it into a fixed-size stack buffer, allowing attackers to overwrite the stack frame and hijack the instruction pointer.
2. Exploitation Mechanics & Attack Scenario
An unauthenticated attacker can exploit this vulnerability by sending a specially crafted HTTP POST request targeting the Home Network Administration Protocol (HNAP) service handled by cgibin. By injecting an oversized payload into specific HTTP headers or parameters, the attacker triggers a buffer overflow in the hnap_main context. This allows the attacker to control CPU registers, execute arbitrary shellcode, and spawn a root shell. This vulnerability is actively exploited in the wild and is listed in the CISA KEV catalog.
3. Infrastructure & Business Impact
Successful exploitation grants the attacker full administrative control over the router. This can lead to lateral movement within the internal network (LAN), credential theft, DNS hijacking, and traffic interception. Furthermore, compromised routers are frequently recruited into IoT botnets (such as Mirai) to launch large-scale Distributed Denial of Service (DDoS) attacks, posing severe operational and reputational risks.
Official Vendor Advisories & References
D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Buffer Overflow via cgibin, hnap_main,
Frequently Asked SecOps Questions (CVE-2022-37055)
FAQQ1. How critical is CVE-2022-37055 and is it actively exploited in the wild?
CVE-2022-37055 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 55.5%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2022-37055?
Primary impacted vendors include d-link across go-rt-ac750. Scope summary: D-Link GO-RT-AC750 revA (v101b03 and prior), GO-RT-AC750 revB (FWv200b02 and prior)
Q3. What temporary mitigations or workarounds exist for CVE-2022-37055 before patching?
[Mitigation] Apply the latest firmware updates immediately, or replace end-of-life (EoL) devices and disable remote WAN management interfaces. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2022-37055
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (d-link)
View Category →D-Link DIR-505 Router TFTP File Upload Stack-Based Buffer Overflow (CVE-2026-120189) Technical Analysis and Mitigation Guide
[Affected Scope] D-Link DIR-505 firmware version 1.10B02 and prior
Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Adobe Commerce (Magento) Server-Side Template Injection (SSTI) Remote Code Execution (CVE-2026-75650)
[Affected Scope] All unpatched versions of Adobe Commerce and Magento Open Source.
Metabase /reset_password Endpoint Unauthenticated SQL Injection and Admin Takeover (CVE-2026-72898)
[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.