Digest · Sunday

Security digest: August 28, 2022

1 editorial brief.

All digests · RSS · Markdown

Take stock

Check exposure: D-Link GO-RT-AC750 CVE-2022-37055: EOL Router Bug in KEV. Anyone with a D-Link GO-RT-AC750 still in use, including branch offices, labs and remote workers' home networks that carry company traffic.
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

Aug 28, 2022 · Vulnerability · CVE-2022-37055

D-Link GO-RT-AC750 CVE-2022-37055: EOL Router Bug in KEV

This is an unpatchable bug in a consumer router D-Link stopped supporting in 2020 and a Mirai-based botnet now uses it; the job is to find any GO-RT-AC750 still in service and replace it.

Must act: Anyone with a D-Link GO-RT-AC750 still in use, including branch offices, labs and remote workers' home networks that carry company traffic.

Can relax: Organizations with no GO-RT-AC750 units anywhere in their estate; the CVE is specific to this model.

Inventory routers in branch offices, labs and remote-worker kits and flag any D-Link GO-RT-AC750.
Replace every GO-RT-AC750 with a supported router; D-Link will not release a fix.
Until a unit is replaced, make sure its web and HNAP management interface is not reachable from the internet.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.