CVE-2022-37056

Public exploit available. Not confirmed exploited in the wild yet. A vendor fix is available.

CVSS 3.19.8Critical EPSS percentile96th10% chance in 30 days CISA KEVNot listedNo confirmed exploitation
Public exploit: 1 source FixVendor fixNo build named by the sources

Published 2022-08-28Updated 2025-12-09Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check whether your D-Link GO-RT-AC750 router is running GORTAC750_revA_v101b03 or GO-RT-AC750_revB_FWv200b02.
If you are on one of those affected firmware versions, download the vendor-fixed firmware from D-Link’s security publication for SAP10308.
Upgrade the router firmware to the fixed version provided by D-Link, following their upgrade instructions.
After upgrading, verify the router reports the new firmware version and that remote/admin access is not unnecessarily exposed to the internet (block or restrict external access where possible).

Vendor advisory Some work to apply

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

D-Link GO-RT-AC750 GORTAC750_revA_v101b03 and GO-RT-AC750_revB_FWv200b02 is vulnerable to Command Injection via /cgibin, hnap_main,

In plain language

Written by AI from the record

CVE-2022-37056 is a serious security bug in certain D-Link GO-RT-AC750 router firmware versions that can let an attacker run commands on the router over the network without a login. If your business uses these exact firmware versions, you should act because it can lead to full router takeover.

CVE-2022-37056 is a command injection vulnerability in D-Link GO-RT-AC750 firmware that allows an unauthenticated remote attacker to execute arbitrary system commands via crafted requests to the /cgibin (and related hnap_main) endpoints, potentially resulting in full device compromise.

If you're affected

Full router takeover
Network outage or disruption
Traffic interception risk
Malware persistence on router

What is it

This bug is like a “command shell” left unlocked inside the router’s software. If someone can reach the router’s affected web endpoints, they may be able to send instructions that make the router run commands as if they had admin control. In practice, that can mean attackers can disrupt your network, spy on traffic, or install lasting changes on the router itself.

Who is affected

This matters if you run or manage D-Link GO-RT-AC750 routers using firmware GORTAC750_revA_v101b03 or GO-RT-AC750_revB_FWv200b02. The issue is network-reachable and does not require a login, which increases risk when the router is exposed beyond your local network. It’s only a real risk if an attacker can reach the router’s exposed management/web endpoints from the network (for example, via the internet).

How urgent is it

This should be treated as urgent for affected firmware because it allows attackers to execute arbitrary commands on the router and can lead to full device control. While it isn’t listed in CISA KEV, there is a public exploit available and press attention is rising, so waiting increases the chance of opportunistic attacks targeting exposed routers.

What to do — in detail

Confirm whether you’re affected

Log in to the D-Link GO-RT-AC750 admin interface (locally, if possible) and find the firmware version.
Determine if it is exactly one of these affected versions:
- GORTAC750_revA_v101b03
- GO-RT-AC750_revB_FWv200b02

Upgrade to the fixed firmware

Use D-Link’s published remediation for SAP10308 (vendor links are provided in the advisory and vendor patch materials).
Download the fixed firmware from the D-Link security publication page or the linked remediation files.
Follow D-Link’s upgrade procedure (don’t interrupt power during the update).
After the upgrade, re-check the router’s firmware version to confirm it is no longer one of the affected releases.

If patching is delayed (reduce exposure)

If your router is reachable from the internet, restrict or block external access to the router’s web/API endpoints.
Use network controls (firewall rules) so the router management interfaces are only accessible from your internal network.
Verify that no port-forwarding or “remote management from WAN” settings are unnecessarily enabled.

Monitor after the change

Review router/admin logs for unusual requests targeting CGI/management endpoints.
If your organization uses network monitoring, watch for unexpected outbound connections originating from the router’s IP.

Timing

D-Link’s fixed firmware is the definitive remediation; prioritize upgrading as soon as practical after confirming you are on an affected firmware version.

Technical context

Severity is high (CVSS shown as 9.8). The weakness is CWE-78 (command injection). The attack mechanism is sending crafted network requests to the router’s /cgibin endpoint (and related hnap_main) so the router executes attacker-supplied commands on the underlying system.

Findings indicate:

Authentication is not required (unauthenticated remote trigger).
No user interaction is needed.
A public exploit is available (weaponization exists).
KEV (CISA) is not listed for this CVE, so widespread confirmed remediation-driven alerts aren’t indicated by KEV.
EPSS is provided as a prediction, but public blocklists here rely more on the confirmed presence of public exploitation and the AMBER (not the highest) traffic-light verdict.

Practical takeaway: if the affected endpoints are reachable from the network/internet, an attacker can potentially take over the router or disrupt/inspect traffic through command execution and resulting device compromise.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS96th

Public exploit

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

1 source with a proof of concept or module.

Exploit links, PoCs and Metasploit modules after sign-in

EPSS

10% chance of exploitation activity in the next 30 days, which ranks it in the 96th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

The patch came 87 days before any public exploit.

2026-08-25EPSS band changelow → moderateepss band change
2026-08-03EPSS band changemoderate → 0epss band change
2026-03-06Public exploit / PoCsource: other
2025-12-09Patch availablerecord updated
2022-08-28Publishedweakness classified, att&ck mapped

Affected products

D-Link Corp.commercial · TWaka dlink, d-link international, d-link corporation
- go-rt-ac750 firmwareNetworking Infrastructure
- GO-RT-AC750Networking Infrastructure

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 9.8 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable