CVE-2022-37055: D-Link Go-RT-AC750 router buffer overflow in cgibin hnap_main

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8 unauthenticated remote buffer overflow on an edge router, listed in CISA KEV with high EPSS and evidence of in-the-wild exploitation.

What it is

D-Link Go-RT-AC750 firmware revisions A v101b03 and B v200b02 contain a classic buffer overflow reachable through the cgibin hnap_main handler. The flaw is remotely exploitable without authentication or user interaction, and the vendor has published a security advisory. Because the device is a network edge router, successful exploitation can compromise the whole network behind it.

Impact

An unauthenticated remote attacker can overflow the buffer to corrupt memory and potentially achieve arbitrary code execution on the router. That yields full control of the device, including its traffic and any credentials or sessions passing through it.

Attack surface

Reached over the network through the router's HTTP/cgibin HNAP interface, per the CVSS vector AV:N/AC:L/PR:N/UI:N. No authentication or user interaction is required.

Exploitation

CVE-2022-37055 is listed in CISA KEV with a due date of 2025-12-29, and EPSS gives a 30-day probability of 0.555 (99th percentile). References include an exploit-tagged third-party advisory and a Fortiguard outbreak alert, indicating active exploitation in the wild.

What to do

• Apply the vendor fix per D-Link security advisory SAP10308; if no patch exists for your revision, discontinue use of the device as CISA directs.
• Replace end-of-life Go-RT-AC750 units that no longer receive firmware updates.
• Disable or block remote access to the router's web/HNAP management interface from the WAN; restrict administration to the LAN.
• Segment or isolate the router from sensitive internal networks until it is patched or replaced.
• Monitor vendor and CISA guidance for updated firmware or replacement recommendations.

Detection

• Inspect router and perimeter logs for anomalous requests to /cgibin or HNAP endpoints, especially oversized or malformed payloads.
• Alert on unexpected router reboots, crashes, or process restarts that could indicate a failed overflow attempt.
• Monitor for new outbound connections or configuration changes originating from the router itself.
• Use network monitoring to detect exploitation attempts against D-Link Go-RT-AC750 devices on the network.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.