CISA Alerts Users to Active Attacks Exploiting D-Link Router Buffer Overflow Flaw

The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent warning to federal agencies and private organizations regarding a critical security flaw in D-Link routers that is currently being exploited in active cyberattacks.

On December 8, 2025, CISA added the vulnerability, tracked as CVE-2022-37055, to its Known Exploited Vulnerabilities (KEV) catalog, signaling a significant risk to network security.

Field	Data
CVE ID	CVE-2022-37055
Vulnerability Type	Buffer Overflow
Affected Vendor	D-Link (Routers)

Understanding the Buffer Overflow Risk

The vulnerability is classified as a “buffer overflow” flaw. In simple terms, this means the router’s software attempts to write more data to a specific storage area (a buffer) than the buffer can hold.

When this limit is exceeded, the extra data spills over into adjacent memory.

Attackers can exploit this “spillover” to overwrite critical instructions, causing the device to crash or, more dangerously, to execute malicious code.

Successful exploitation can give hackers complete control over the router, compromising the confidentiality, integrity, and availability of the entire network it protects.

A significant concern with this specific alert is that many of the affected D-Link routers are likely End-of-Life (EoL) or End-of-Service (EoS).

This means the manufacturer no longer supports them and will not release software updates to fix the flaw.

Running unsupported hardware is a security gamble. Without official patches, these devices remain permanently vulnerable to the active attacks CISA has identified.

Attackers often target these legacy devices to build botnets of infected devices used to launch larger attacks or steal data.

CISA has mandated that federal civilian executive branch (FCEB) agencies address this vulnerability by December 29, 2025.

However, the agency strongly urges all organizations and home users to take action immediately.

Since many impacted models will not receive a patch, the primary recommendation is to discontinue use immediately.

Users should disconnect vulnerable D-Link routers from the internet and replace them with supported, secure alternatives.

If a vendor mitigation is available for your specific model, apply it instantly; otherwise, the device is a liability.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.