erroneo.us
Search all guides⌘K

Security Digest · Aug 28, 2022 · Vulnerability · Network edge

D-Link GO-RT-AC750 CVE-2022-37055: EOL Router Bug in KEV

A 2022 buffer overflow in end-of-life D-Link GO-RT-AC750 routers joined CISA KEV in Dec 2025 after ShadowV2 botnet use. No fix exists; replace them.

Published By erroneo.us Security Desk · Updated 3 min read6 sources

Our verdict

Check exposure

This is an unpatchable bug in a consumer router D-Link stopped supporting in 2020 and a Mirai-based botnet now uses it; the job is to find any GO-RT-AC750 still in service and replace it.

Who must act: Anyone with a D-Link GO-RT-AC750 still in use, including branch offices, labs and remote workers' home networks that carry company traffic.

Who can relax: Organizations with no GO-RT-AC750 units anywhere in their estate; the CVE is specific to this model.

Affected
D-Link GO-RT-AC750 (non-US), all hardware revisions and firmware versions, including revA v1.01b03 and revB v2.00b02
Fixed in
None: D-Link lists the product as end-of-life with no fixed firmware; replacement is the only fix
CVSS
9.8 (v3.1, CISA-ADP)
EPSS
55.5% (percentile 99)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Inventory routers in branch offices, labs and remote-worker kits and flag any D-Link GO-RT-AC750.
  2. Replace every GO-RT-AC750 with a supported router; D-Link will not release a fix.
  3. Until a unit is replaced, make sure its web and HNAP management interface is not reachable from the internet.
  4. Scan your public IP ranges for router admin interfaces and close anything that answers.
  5. Treat any unit that was exposed as possibly part of a botnet: factory-reset it, then retire it.

How to check if you are affected or compromised

  • Look for outbound connections from the router or its network to the ShadowV2 indicators, such as 81.88.18.108 and silverpath[.]shadowstresser[.]info.
  • Watch for unexplained traffic spikes or DDoS-like outbound floods from small-office networks.
  • Check surviving units for changed DNS settings, unknown admin accounts or remote management turned on.

What happened#

On August 28, 2022, a CVE was published for a buffer overflow in the D-Link GO-RT-AC750, a small dual-band consumer router. The CVE record says firmware GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable through cgibin and hnap_main. HNAP is the router's management API, served by its web server. CISA's enrichment scores it CVSS 3.1 9.8: network attack, no login, no user action. D-Link's advisory SAP10308, first published September 13, 2022, covers it with two command injection bugs, CVE-2022-37056 and CVE-2022-37057. It says the report came through CERT/CC and that no fixed firmware is available.

More than three years later, on December 8, 2025, CISA added the CVE to the KEV catalog "based on evidence of active exploitation." An Array Networks ArrayOS bug was added the same day. The entry warns that the products may be end-of-life and tells users to stop using them. Federal agencies had until December 29, 2025.

Why a 2022 bug was added in late 2025#

CISA does not say what evidence it used. The most likely public source is FortiGuard Labs' ShadowV2 report, published November 26, 2025, twelve days before the listing. Fortinet describes ShadowV2 as a botnet built on Mirai for IoT devices. It spread during a global AWS outage at the end of October 2025, possibly as a test run. Its list of eight exploited bugs includes CVE-2022-37055 and three other D-Link flaws: CVE-2020-25506, CVE-2024-10914 and CVE-2024-10915. Fortinet saw activity in 28 countries, including the United States, Canada and the United Kingdom. Fortinet does not describe the exact request used against this router. CISA has not confirmed that this report led to the listing.

Who is affected#

SAP10308 covers the non-US GO-RT-AC750, all hardware revisions and all firmware versions. D-Link lists its end of service as February 29, 2020. It recommends retiring the device and contacting the regional office for a replacement.

Do you really need to act?#

Only if you still have one. Enterprises rarely buy this model, and it was not sold through D-Link US. The realistic risk is a forgotten unit in a small office, a lab, or an employee's home. Such a router can be enrolled in a DDoS botnet or used to watch and redirect traffic. No patch will ever come, so do not plan around one.

What to do now#

  1. Inventory routers outside your managed network gear, including branch, lab and home-office kits. The model name is on the label under the device.
  2. Replace every GO-RT-AC750 with a supported router.
  3. Until it is replaced, keep the management interface off the internet. Scan your public ranges, for example nmap -Pn -p 80,443,8080 <public-range>, and close anything that answers from a router.
  4. Factory-reset any unit that was exposed before you retire it, so it stops taking part in attacks.

How to tell if you were hit#

Botnet infections on consumer routers rarely leave anything a user can see. Look at the network instead. Fortinet lists the downloader binary.sh, delivered from 81.88.18.108, and the command server silverpath[.]shadowstresser[.]info. It also lists 198.199.72.27 as an exploit source. Search firewall and DNS logs for these, and for sudden outbound floods from small-office links. On any surviving unit, check DNS settings, admin accounts and whether remote management is on.

Timeline#

  • — The GO-RT-AC750 reaches end of service.
  • — CVE-2022-37055 is published.
  • — D-Link publishes SAP10308 with no fix.
  • — FortiGuard reports ShadowV2 exploiting the bug.
  • — CISA adds the CVE to KEV. D-Link updates SAP10308 the same day.
  • — Federal remediation deadline.

Vulnerability records

  • CVE-2022-37055 · KEV 2025-12-08 · D-Link Go-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 are vulnerable to Buffer Overflow via cgibin, hnap_main,

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. D-Link — SAP10308: (Non-US) GO-RT-AC750 multiple vulnerabilities, EOL/EOS supportannouncement.us.dlink.com
  2. CVE record — CVE-2022-37055 cve.org
  3. NVD — CVE-2022-37055 nvd.nist.gov
  4. CISA — Known Exploited Vulnerabilities: CVE-2022-37055 cisa.gov
  5. CISA — CISA Adds Two Known Exploited Vulnerabilities to Catalog (Dec 8, 2025) cisa.gov
  6. Fortinet FortiGuard Labs — ShadowV2 Casts a Shadow Over IoT Devices fortinet.com