CVE-2022-37055

This is a classic stack buffer overflow in the web management interface of D-Link's Go-RT-AC750 router, reached through the cgibin binary's hnap_main handler. HNAP is D-Link's SOAP-based device management protocol, and the handler copies attacker-controlled input from the request into a fixed-size buffer without bounds checking. An attacker on the network who can reach the web interface sends an oversized crafted request, overruns the buffer, and can corrupt memory to hijack execution flow on the device.

Consumer and small-office routers like this are exactly the gear that never gets firmware updates and often ends up with its management interface exposed, and D-Link SOHO routers are a perennial target for botnet operators assembling Mirai-style networks for DDoS and proxying. Because the flaw is in the router's own web stack, a successful overflow gives control of the device itself, a foothold that sits in front of everything on the LAN. Apply any vendor firmware update if one exists, disable remote/WAN administration, and where the model is end-of-life the realistic remediation is replacing the hardware rather than trusting a patch.