--- title: "D-Link GO-RT-AC750 CVE-2022-37055: EOL Router Bug in KEV" url: https://erroneo.us/security/briefs/d-link-go-rt-ac750-cve-2022-37055-buffer-overflow-kev/ description: "A 2022 buffer overflow in end-of-life D-Link GO-RT-AC750 routers joined CISA KEV in Dec 2025 after ShadowV2 botnet use. No fix exists; replace them." type: security-brief section: "Security Digest" date_published: 2022-08-28 date_modified: 2026-10-23 publisher: erroneo.us author: erroneo.us Security Desk verdict: "Check exposure" cves: ["CVE-2022-37055"] severity: "critical" exploited: "in-the-wild" kev: true license: All rights reserved. Quote with attribution and a link. --- # D-Link GO-RT-AC750 CVE-2022-37055: EOL Router Bug in KEV **Verdict: Check exposure.** This is an unpatchable bug in a consumer router D-Link stopped supporting in 2020 and a Mirai-based botnet now uses it; the job is to find any GO-RT-AC750 still in service and replace it. - **Who must act:** Anyone with a D-Link GO-RT-AC750 still in use, including branch offices, labs and remote workers' home networks that carry company traffic. - **Who can relax:** Organizations with no GO-RT-AC750 units anywhere in their estate; the CVE is specific to this model. - **Affected:** D-Link GO-RT-AC750 (non-US), all hardware revisions and firmware versions, including revA v1.01b03 and revB v2.00b02 - **Fixed:** None: D-Link lists the product as end-of-life with no fixed firmware; replacement is the only fix - **CVEs:** CVE-2022-37055 - **CISA KEV:** yes · **Exploitation:** Exploited in the wild ## What to do 1. Inventory routers in branch offices, labs and remote-worker kits and flag any D-Link GO-RT-AC750. 2. Replace every GO-RT-AC750 with a supported router; D-Link will not release a fix. 3. Until a unit is replaced, make sure its web and HNAP management interface is not reachable from the internet. 4. Scan your public IP ranges for router admin interfaces and close anything that answers. 5. Treat any unit that was exposed as possibly part of a botnet: factory-reset it, then retire it. ### How to check if you are affected - Look for outbound connections from the router or its network to the ShadowV2 indicators, such as 81.88.18.108 and silverpath[.]shadowstresser[.]info. - Watch for unexplained traffic spikes or DDoS-like outbound floods from small-office networks. - Check surviving units for changed DNS settings, unknown admin accounts or remote management turned on. ## What happened On August 28, 2022, a CVE was published for a buffer overflow in the D-Link GO-RT-AC750, a small dual-band consumer router. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2022-37055) says firmware `GORTAC750_revA_v101b03` and `GO-RT-AC750_revB_FWv200b02` are vulnerable through `cgibin` and `hnap_main`. HNAP is the router's management API, served by its web server. CISA's enrichment scores it CVSS 3.1 9.8: network attack, no login, no user action. D-Link's advisory [SAP10308](https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10308), first published September 13, 2022, covers it with two command injection bugs, CVE-2022-37056 and CVE-2022-37057. It says the report came through CERT/CC and that no fixed firmware is available. More than three years later, on December 8, 2025, CISA [added](https://www.cisa.gov/news-events/alerts/2025/12/08/cisa-adds-two-known-exploited-vulnerabilities-catalog) the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-37055) "based on evidence of active exploitation." An Array Networks ArrayOS bug was added the same day. The entry warns that the products may be end-of-life and tells users to stop using them. Federal agencies had until December 29, 2025. ## Why a 2022 bug was added in late 2025 CISA does not say what evidence it used. The most likely public source is [FortiGuard Labs' ShadowV2 report](https://www.fortinet.com/blog/threat-research/shadowv2-casts-a-shadow-over-iot-devices), published November 26, 2025, twelve days before the listing. Fortinet describes ShadowV2 as a botnet built on Mirai for IoT devices. It spread during a global AWS outage at the end of October 2025, possibly as a test run. Its list of eight exploited bugs includes CVE-2022-37055 and three other D-Link flaws: CVE-2020-25506, CVE-2024-10914 and CVE-2024-10915. Fortinet saw activity in 28 countries, including the United States, Canada and the United Kingdom. Fortinet does not describe the exact request used against this router. CISA has not confirmed that this report led to the listing. ## Who is affected SAP10308 covers the non-US GO-RT-AC750, all hardware revisions and all firmware versions. D-Link lists its end of service as February 29, 2020. It recommends retiring the device and contacting the regional office for a replacement. ## Do you really need to act? Only if you still have one. Enterprises rarely buy this model, and it was not sold through D-Link US. The realistic risk is a forgotten unit in a small office, a lab, or an employee's home. Such a router can be enrolled in a DDoS botnet or used to watch and redirect traffic. No patch will ever come, so do not plan around one. ## What to do now 1. Inventory routers outside your managed network gear, including branch, lab and home-office kits. The model name is on the label under the device. 2. Replace every GO-RT-AC750 with a supported router. 3. Until it is replaced, keep the management interface off the internet. Scan your public ranges, for example `nmap -Pn -p 80,443,8080 `, and close anything that answers from a router. 4. Factory-reset any unit that was exposed before you retire it, so it stops taking part in attacks. ## How to tell if you were hit Botnet infections on consumer routers rarely leave anything a user can see. Look at the network instead. Fortinet lists the downloader `binary.sh`, delivered from `81.88.18.108`, and the command server `silverpath[.]shadowstresser[.]info`. It also lists `198.199.72.27` as an exploit source. Search firewall and DNS logs for these, and for sudden outbound floods from small-office links. On any surviving unit, check DNS settings, admin accounts and whether remote management is on. ## Timeline - Feb 29, 2020 — The GO-RT-AC750 reaches end of service. - Aug 28, 2022 — CVE-2022-37055 is published. - Sep 13, 2022 — D-Link publishes SAP10308 with no fix. - Nov 26, 2025 — FortiGuard reports ShadowV2 exploiting the bug. - Dec 8, 2025 — CISA adds the CVE to KEV. D-Link updates SAP10308 the same day. - Dec 29, 2025 — Federal remediation deadline. ## Sources 1. [D-Link — SAP10308: (Non-US) GO-RT-AC750 multiple vulnerabilities, EOL/EOS](https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10308) 2. [CVE record — CVE-2022-37055](https://www.cve.org/CVERecord?id=CVE-2022-37055) 3. [NVD — CVE-2022-37055](https://nvd.nist.gov/vuln/detail/CVE-2022-37055) 4. [CISA — Known Exploited Vulnerabilities: CVE-2022-37055](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-37055) 5. [CISA — CISA Adds Two Known Exploited Vulnerabilities to Catalog (Dec 8, 2025)](https://www.cisa.gov/news-events/alerts/2025/12/08/cisa-adds-two-known-exploited-vulnerabilities-catalog) 6. [Fortinet FortiGuard Labs — ShadowV2 Casts a Shadow Over IoT Devices](https://www.fortinet.com/blog/threat-research/shadowv2-casts-a-shadow-over-iot-devices) --- Source page: https://erroneo.us/security/briefs/d-link-go-rt-ac750-cve-2022-37055-buffer-overflow-kev/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt