Is CVE-2022-37055 (D-Link Routers Buffer Overflow) being exploited in the wild?

What this KEV listing means for exposure and response

A KEV listing means the vulnerability has crossed from theoretical risk into confirmed exploitation. For defenders, the practical question is not whether the issue is severe in the abstract, but whether the affected D-Link router is present anywhere in the estate, especially at the network edge where unmanaged devices are easy to miss and harder to monitor.

Because CISA added CISA Known Exploited Vulnerabilities Catalog entries only after reliable evidence of active exploitation, a KEV-listed router flaw should be treated as an urgent exposure. Use the vendor advisory and the catalog entry together to confirm exactly which models and firmware branches are affected, then move the device out of service or into a protected state if immediate remediation is not possible.

Why buffer overflows on routers are high-consequence defects

Router buffer overflows matter because they sit on trusted infrastructure that often has broad network reach, weak telemetry, and long patch intervals. A flaw in the routing layer can become a foothold for remote code execution, configuration tampering, traffic interception, or simple denial of service, depending on how the overflow is triggered and what the attacker can influence after execution.

The vulnerability type also matters operationally. Buffer overflows tend to be triggered remotely, can be repeatable at scale, and may be exploitable without user interaction. For a perimeter or branch router, that means the blast radius can extend beyond the device itself into connected internal services, remote access paths, and downstream monitoring blind spots.

What to do before and after remediation

Start by confirming whether the vulnerable D-Link model is actually deployed, including remote offices, consumer-grade devices used in small branches, and replacement units that may have been forgotten in inventory. Then compare your firmware state to the vendor advisory rather than relying on the KEV entry alone, since KEV confirms exploitation but does not replace version guidance.

If patching must wait, isolate the device as much as possible, remove unnecessary management exposure, restrict inbound reachability to the smallest set of trusted sources, and increase logging around any configuration changes or crashes. After remediation, verify that the router returns to normal service, then review whether the device showed signs of pre-remediation tampering, unusual resets, unexpected configuration drift, or traffic anomalies.

Risk and Threat Considerations

This is a live exploitation problem, not just a hygiene issue. A vulnerable router can provide direct network access at a point that defenders often assume is stable and low-noise, which makes it attractive for opportunistic attackers and for follow-on activity if they can persist or alter traffic paths.

Failure mechanism: A remotely reachable buffer overflow may let an attacker crash the router, execute code, or modify configuration state before defenders notice. On edge infrastructure, that can bypass normal endpoint controls and expose internal segments that were never meant to be directly reachable.

Impact: Expect confidentiality, integrity, and availability loss to be credible outcomes, along with potential credential exposure, traffic redirection, and loss of trust in the device until it is rebuilt or replaced.

Practitioner Guidance

What to prioritise: Treat internet-facing and branch-edge routers as first-class assets in vulnerability response. A KEV-listed network device should move ahead of routine patch queues, especially when it sits between untrusted networks and sensitive internal services.

What to verify: Confirm exact hardware model, firmware line, management exposure, and whether the device has any compensating controls such as upstream filtering or dedicated admin isolation. If you cannot prove the device is absent, assume it is present until inventory says otherwise.

Decision rule: If the router can be patched quickly and safely, patch first; if it cannot, constrain exposure immediately and plan for replacement or rebuild. For edge devices, a fast isolation step is often more valuable than waiting to prove exploitation before acting.

Practitioner takeaway: KEV status changes the operating assumption: remediation is urgent because active exploitation is already established, so the main decision is how fast you can reduce reachability and restore trust in the device.

Related resources from NHI Mgmt Group

• Guide: IoT Security Guide
• How do you patch or mitigate CVE-2022-37055 (D-Link Routers Buffer Overflow)?
• Is CVE-2022-20708 (Cisco Small Business RV Series Routers Stack-based Buffer Overflow) being exploited in the wild?
• Is CVE-2022-20701 (Cisco Small Business RV Series Routers Stack-based Buffer Overflow) being exploited in the wild?
• Is CVE-2022-20703 (Cisco Small Business RV Series Routers Stack-based Buffer Overflow) being exploited in the wild?