CVE-2022-37055 D-Link Router Buffer Overflow Exploitation
Detects exploitation attempts targeting CVE-2022-37055, a buffer overflow vulnerability (CWE-120) in D-Link routers. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. Attackers may exploit this vulnerability to achieve remote code execution on affected D-Link routers, potentially enabling network pivoting, persistent access, or botnet enrollment.
Vulnerability Intelligence
KEV — Known ExploitedAffected Software
- Vendor
- D-Link
- Product
- Routers
Weakness (CWE)
Timeline
- Disclosed
- December 8, 2025
CVSS
What is CVE-2022-37055 CVE-2022-37055 D-Link Router Buffer Overflow Exploitation?
CVE-2022-37055 D-Link Router Buffer Overflow Exploitation (CVE-2022-37055) maps to the Initial Access and Execution and Lateral Movement tactics — the adversary is trying to get into your network in MITRE ATT&CK.
This page provides production-ready detection logic for CVE-2022-37055 D-Link Router Buffer Overflow Exploitation, covering the data sources and telemetry it touches: CommonSecurityLog, NetworkAnalytics, AzureNetworkAnalytics_CL. The queries below are rated critical severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.
MITRE ATT&CK
let dlink_device_ips = dynamic([]);
let suspicious_payloads = dynamic(['%2F..%2F', '../', 'cmd=', 'shell=', '/bin/sh', '/bin/bash', 'wget ', 'curl ']);
CommonSecurityLog
| where TimeGenerated >= ago(24h)
| where DeviceVendor has_any ('D-Link', 'DLink') or DeviceProduct has_any ('Router', 'DIR-', 'DSR-', 'DWR-')
| where Activity has_any ('buffer', 'overflow', 'exploit', 'attack') or RequestURL has_any (suspicious_payloads)
| extend SourceHost = SourceIP, TargetDevice = DestinationIP
| project TimeGenerated, SourceHost, TargetDevice, Activity, RequestURL, DeviceVendor, DeviceProduct, Message
| union (
NetworkAnalytics
| where TimeGenerated >= ago(24h)
| where DestinationPort in (80, 443, 8080, 8443, 23, 22)
| where FlowDirection == 'I'
| extend PayloadLength = toint(BytesSent)
| where PayloadLength > 65000
| project TimeGenerated, SourceHost = SrcIp, TargetDevice = DestIp, Activity = 'Large payload to potential router', RequestURL = '', DeviceVendor = 'Unknown', DeviceProduct = 'Network Device', Message = strcat('Large inbound payload: ', tostring(PayloadLength), ' bytes')
)
| order by TimeGenerated descDetects exploitation attempts against D-Link routers via CommonSecurityLog entries and network analytics showing anomalous large payloads or known exploit patterns targeting router management interfaces.
Data Sources
Required Tables
False Positives
- Legitimate firmware update traffic generating large payloads to router management interfaces
- Network scanning tools performing authorized vulnerability assessments against D-Link devices
- Router management software sending large configuration payloads during bulk provisioning
- Security monitoring appliances generating CommonSecurityLog events during normal signature updates
Sigma rule & cross-platform mapping
The detection logic for CVE-2022-37055 D-Link Router Buffer Overflow Exploitation (CVE-2022-37055) above is provided in a vendor-neutral
form so you can deploy it on any SIEM. The same logic is shipped here as native
KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the
following logsource:
logsource:
category: network_connection
product: windowsBrowse the community-maintained Sigma rules for this technique:
Platform-specific guides for CVE-2022-37055
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1CVE-2022-37055 Buffer Overflow Simulation via Oversized HTTP POST
Expected signal: Network logs showing HTTP POST request to port 80 with Content-Length > 65000 bytes destined for router management interface IP. IDS alerts for anomalous payload size.
- Test 2Path Traversal Probe Against D-Link Router Management Interface
Expected signal: Web server access logs or proxy logs showing GET requests with '../' or '%2F..%2F' sequences to router management CGI paths. Firewall logs capturing the HTTP request URLs.
- Test 3Reverse Shell Listener Simulation Post Router Compromise
Expected signal: Netflow/IPFIX records showing TCP connection attempts from router management IP to high-risk ports (4444, 1337, etc.). EDR network telemetry if agent is installed on network capture host.
- Test 4CVE-2022-37055 IDS Signature Validation
Expected signal: IDS/IPS alerts firing on CVE-2022-37055 signature, command injection patterns (wget, shell commands in POST body), and anomalous User-Agent strings in network monitoring.
Unlock Pro Content
Get the full detection package for CVE-2022-37055 including response playbook, investigation guide, and atomic red team tests.