{"id":"CVE-2022-37055","kind":"vulnerability","aliases":["CVE-2022-37055"],"related":[],"title":"dlink go-rt-ac750 firmware: D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Buffer Overflow via…","description":"D-Link Routers contains a buffer overflow vulnerability that has a high impact on confidentiality, integrity, and availability. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.\n\nCISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","summary":"D-Link routers contain a buffer overflow that CISA lists as known exploited in the wild. The description says the impact covers confidentiality, integrity and availability, which suggests an attacker could take control of the device or crash it.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2025-12-08T00:00:00+00:00","products":[{"name":"D-Link Routers","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"dlink go-rt-ac750 firmware","fixed":[],"affected":"= 2.00b02","ecosystem":"vendor"},{"name":"dlink go-rt-ac750 firmware","fixed":[],"affected":"= 1.01b03","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["d-link","edge-network","exploited","infrastructure","routers","small-office"],"not_affected_if":["no-d-link-routers"],"how_to_check":"Identify any D-Link router models in use, including those past end-of-life or end-of-service. The sources do not name the affected models or firmware versions.","fix":"Apply the vendor mitigations if D-Link has published them; the sources do not specify them. If no mitigation is available, discontinue use of the device and replace it.","status":"open","published_at":"2022-08-28T17:15:08+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:42:50+00:00","updated_at":"2026-10-23T23:44:51+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-23T20:42:50Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigations if D-Link has published them; the sources do not specify them. If no mitigation is available, discontinue use of the device and replace it.","reach":"unknown","summary":"D-Link routers contain a buffer overflow that CISA lists as known exploited in the wild. The description says the impact covers confidentiality, integrity and availability, which suggests an attacker could take control of the device or crash it.","category":"infrastructure","who_cares":["d-link","routers","edge-network","small-office"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker may fully control the router or knock it offline, since the impact is high on all three CIA properties.","analyst_note":"Find the affected D-Link models and firmware versions and the vendor advisory; the KEV entry gives no product or version detail. Check the CISA KEV page at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-37055.","how_to_check":"Identify any D-Link router models in use, including those past end-of-life or end-of-service. The sources do not name the affected models or firmware versions.","needs_analyst":true,"not_affected_if":["no-d-link-routers"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000486,"input_tokens":2558,"output_tokens":461,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-01':155C '-2022':31A,34A '-37055':32A,35A '22':154C 'ac750':5A,13A,21A,44A,50A 'action':145C 'and/or':132C 'appli':146C 'applic':152C 'attack':94B 'avail':90B,121C 'bod':153C 'buffer':27A,70B,109C 'cisa':73B,143C 'cloud':158C 'confidenti':87B,118C 'contain':68B,107C 'control':97B 'could':95B,125C 'cover':86B 'crash':102B 'cve':30A,33A 'd':8A,37A,53B,65B,104C 'd-link':7A,36A,52B,64B,103C 'descript':82B 'devic':100B 'discontinu':140C,161C 'dlink':1A,40A,46A 'edg':56B 'edge-network':55B 'end':128C,134C 'end-of-lif':127C 'end-of-servic':133C 'eo':137C 'eol':131C 'exploit':58B,77B 'firmwar':6A 'firmware':45A,51A 'follow':151C 'fwv200b02':23A 'go':3A,11A,19A,42A,48A 'go-rt-ac750':2A,10A,18A,41A,47A 'gortac750':14A 'guidanc':156C 'high':115C 'impact':85B,116C,123C 'infrastructur':59B 'instruct':150C 'integr':88B,119C 'known':76B 'life':130C 'link':9A,38A,54B,66B,105C 'list':74B 'mitig':147C,167C 'network':57B 'offic':63B 'overflow':28A,71B,110C 'per':148C 'product':124C,141C,165C 'requir':144C 'reva':15A 'revb':22A 'router':60B,67B,106C 'routers':39A 'rt':4A,12A,20A,43A,49A 'say':83B 'servic':136C,159C 'small':62B 'small-offic':61B 'suggest':92B 'take':96B 'unavail':169C 'use':162C 'user':138C 'util':142C 'v101b03':16A 'vendor':149C 'via':29A 'vulner':25A,111C 'wild':80B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2022-08-28T17:15:08+00:00","kev":{"dateAdded":"2025-12-08","dueDate":"2025-12-29","requiredAction":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-37055","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-37055","severity":null,"published_at":"2025-12-08T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T17:39:55+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-37055","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-37055","severity":null,"published_at":"2022-08-28T17:15:08+00:00","modified_at":"2026-06-17T04:54:32+00:00","first_seen_at":"2026-10-23T23:44:51+00:00","fetched_at":"2026-10-23T23:44:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}