CISA Adds Two Critical KEV Vulnerabilities CVE-2022-37055 and CVE-2025-66644

CISA announced this week that it has added two additional vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog: CVE-2022-37055, a buffer overflow affecting certain D‑Link router models, and CVE-2025-66644, an OS command‑injection flaw in Array Networks ArrayOS AG gateways. Both entries are being treated as actively exploited and therefore warrant immediate attention from federal agencies under Binding Operational Directive 22‑01 (BOD 22‑01) — and they should be high priorities for any enterprise that runs the affected products or comparable infrastructure.

Background​

What the KEV Catalog and BOD 22‑01 require​

The KEV Catalog is CISA’s operational instrument for forcing prioritization of vulnerabilities that are demonstrably being used in real attacks. Under BOD 22‑01, federal civilian executive branch (FCEB) agencies must remediate vulnerabilities listed in the KEV Catalog according to the catalog’s timelines: by default, vulnerabilities with CVE identifiers assigned prior to 2021 carry a remediation window of six months, and those assigned from 2021 onward are expected to be mitigated within two weeks, unless CISA prescribes a different schedule for a specific entry. Agencies that cannot remediate within the required timeline are expected to remove or isolate the affected assets from their networks until the risk is mitigated.
Those deadlines are blunt instruments by design: CISA’s goal is operational risk reduction against vulnerabilities demonstrably exploited in the wild. While this course lowers overall risk, it also forces organizations to confront hard operational tradeoffs — accelerated patching windows, potential service interruptions, and the practical realities of outdated or end‑of‑life (EOL) hardware that vendors may no longer patch.

---

Overview of the two newly listed vulnerabilities​

CVE-2022-37055 — D‑Link Go‑RT‑AC750 buffer overflow​

• Affected products: specific builds of the D‑Link Go‑RT‑AC750 family (documented vendor firmware revisions).
• Vulnerability class: stack/heap buffer overflow (CWE‑120), triggered via certain CGI/HNAP endpoints (cgibin, hnap_main) exposed by the device web management interface.
• Exploitation characteristics: remotely exploitable over the network without authentication in vulnerable firmware images, with potential to crash the device or execute arbitrary code at the device level.
• Severity profile: historically scored very high (CVSS v3.x records indicate critical ratings for impacted builds); exploitability is straightforward for attackers who can reach vulnerable management endpoints.
• Mitigations: where vendor firmware updates exist, apply them immediately; if device is EOL or no patch exists, isolate or replace the hardware, disable remote management and HNAP, and implement strict network access controls to management ports.

CVE-2025-66644 — Array Networks ArrayOS AG command injection​

• Affected products: Array Networks ArrayOS AG series prior to 9.4.5.9 (vendor advisory and NVD records indicate 9.4.5.9 as the minimum patched version).
• Vulnerability class: OS command injection (CWE‑78) in a component of the AG gateway that can be reached by authenticated users or by manipulated upstream inputs in certain configurations.
• Exploitation characteristics: requires high privileges for initial access (authenticated administrative context), but once leveraged allows arbitrary OS command execution on the gateway. Multiple credible security groups and incident responders have reported exploitation activity in the wild across the August–December 2025 period, including deployment of web shells and persistence mechanisms.
• Severity profile: assigned a high base score (CVSS ~7.2 in early entries) because the impact is severe despite requiring elevated privileges.
• Mitigations: upgrade ArrayOS to 9.4.5.9 or later immediately, restrict administrative access to trusted management networks and jump hosts, apply multi‑factor authentication (MFA) for any admin interfaces, and hunt for indicators of compromise (IoCs) on gateways and upstream hosts.

---

Technical deep dive and verification​

Why CVE-2022-37055 is dangerous in practice​

• The vulnerability targets management functionality — the path hnap_main exposes HNAP (Home Network Administration Protocol) interfaces commonly used by router vendors for remote management. Attackers who can reach these endpoints can trigger buffer overflow conditions.
• Buffer overflows at the router firmware level frequently allow arbitrary code execution or kernel memory corruption — this can be leveraged to implant persistent malware, add devices to botnets (Mirai‑style activities), or establish residential proxies and pivot points into local networks.
• Many D‑Link devices affected by historical high‑severity bugs are EOL, which raises the operational risk: if no vendor patch is available, defenders must choose between isolation/replacement and living with a near‑unpatchable exposed risk surface.
• Multiple security vendors and vulnerability databases have documented public exploit notices and significant EPSS/scan activity for D‑Link router vulnerabilities in the past; beyond theoretical risk, network telemetry has shown attempts to weaponize these flaws in botnet campaigns.

Why CVE-2025-66644 merits urgent action despite the authentication requirement​

• Although it requires elevated privileges (an admin or equivalent session) to exploit, real‑world attack chains commonly combine initial access vulnerabilities with higher‑privilege flaws. In practice, attackers who can steal admin credentials, brute‑force management endpoints, or abuse weak remote management configurations can leverage this command‑injection bug to achieve full device compromise.
• The reported exploitation timeline (August–December 2025) coincides with observed campaigns that have used Array gateways to plant web shells and pivot to internal resources. Network edge appliances like Array AG boxes sit in high‑value positions — they handle remote access, application delivery, and may terminate VPN/remote desktop traffic — compromising them yields broad access.
• The fix path is straightforward and available: upgrade to ArrayOS 9.4.5.9 or later, which is a major practical advantage over EOL hardware with no vendor support.

---

Immediate actions for defenders — an operational checklist​

The following checklist is prioritized for rapid tactical triage and remediation across enterprises and FCEB networks.

• Inventory and identify
• Enumerate every D‑Link router and Array Networks ArrayOS AG appliance on the network. Use active scans, asset inventory records, and configuration management databases (CMDB) to discover exposed management interfaces.
• Identify device models, firmware versions, and dates of last vendor support.
• Containment and access hardening
• Immediately block or restrict inbound management access from the internet to any affected devices (block ports used by web management, HNAP, SSH/Telnet, and vendor-specific management channels) at perimeter firewalls.
• If possible, remove affected devices from sensitive production networks and move them into an isolated management VLAN that is not routable from general user segments.
• Enforce MFA for any administrative logins and disable default or weak accounts.
• Patch or replace
• For Array Networks: schedule and apply firmware upgrade to ArrayOS 9.4.5.9 or later as an immediate priority. Validate upgrade in a maintenance window and confirm the removal of vulnerable endpoints after patching.
• For D‑Link Go‑RT‑AC750 models: check vendor advisories for firmware updates. If vendor support is unavailable or the model is EOL, replace or isolate the device. If replacement is not immediately possible, apply restrictive access controls and disable HNAP/remote management.
• Hunt and detect
• Search for indicators of compromise: unexpected web shells, changes to gateway configuration, unusual scheduled tasks, new user accounts, and unfamiliar persistent services.
• Check firewall logs, proxy logs, and remote access logs for anomalous sessions originating from public IPs or internal hosts that should not interact with management interfaces.
• Deploy or update IDS/IPS signatures for known exploit fingerprints tied to these CVEs and scan for attempted exploitation in historical logs.
• Remediate and report
• For federal agencies, follow BOD 22‑01 reporting channels: remediate within the KEV-defined timeline (two weeks for recent CVEs, six months for older ones unless otherwise specified) and update CDM/KCD dashboards per agency obligations.
• For private sector entities: document mitigation steps, harden controls, and consider sharing telemetry with trusted information‑sharing organizations (ISACs) to assist collective defense.
• Post‑remediation verification
• After patches or replacements, validate devices by scanning for open management endpoints, re‑running vulnerability scans, and performing controlled penetration tests where feasible.
• Rotate administrative credentials and review configuration backups for secondary backdoors or malicious artifact persistence.

---

Detection and forensic indicators to prioritize​

• Unexplained additions to authorized accounts or administrative groups on devices.
• Presence of web shells or unknown scripts under web interface directories.
• Sudden increases in outgoing connections to suspicious IP addresses or command-and-control infrastructure.
• Crash/restart patterns or newly modified firmware images on routers/gateways.
• Abnormal CLI commands executed on gateways (e.g., OS command execution traced to the management process).
  Implement log retention and centralized collection (SIEM) for management plane telemetry so investigators can reconstruct exploit timelines.

---

Strengths and benefits of adding these CVEs to the KEV Catalog​

• Operational clarity: CISA’s KEV mechanism forces agencies to prioritize a small, evidence‑backed list of vulnerabilities that constitute immediate operational risk. This reduces analysis paralysis and provides explicit deadlines.
• Risk reduction: Listing CVE-2025-66644 and CVE-2022-37055 signals active exploitation and encourages immediate action, which can close windows attackers are actively using.
• Supply‑chain pressure: Public KEV inclusion creates urgency for vendors to publish patches and support guidance, and it motivates procurement and asset management teams to accelerate device replacements for EOL hardware.

---

Practical risks, operational friction, and potential downsides​

• Vendor support gaps: Many router vendors (including some D‑Link models) have EOL devices in the wild. KEV is effective only if a vendor provides patches; without a patch, agencies must isolate or replace hardware — actions that are costly and operationally disruptive.
• Patch‑induced outages: Rapid remediation windows (two weeks) create a real risk of service outages if upgrades are not properly tested. Patching routers and gateways typically requires maintenance windows, rollover plans, and rollback strategy.
• Resource strain: Smaller agencies and organizations with constrained operational staff may struggle to meet KEV timelines, increasing reliance on compensating controls that are sometimes imperfect (e.g., segmentation that still allows adversary lateral movement).
• False sense of completeness: KEV’s focus on known exploited vulnerabilities is valuable — but it’s not comprehensive. Organizations must not abandon broader vulnerability management, threat hunting, and endpoint protections just because a CVE is not in the KEV list.

---

Long‑term recommendations and best practices​

• Maintain a living, machine‑readable inventory that maps asset identity to vendor, model, firmware, and business criticality. KEV compliance depends on accurate asset data.
• Integrate KEV feeds and patch deadlines into ITSM change workflows and automation pipelines so that remediation becomes an auditable business process rather than an ad‑hoc scramble.
• Adopt zero‑trust access models for management planes: management VLANs, strict host allowlists, bastion/jump hosts with MFA and short‑lived credentials.
• Plan for EOL: create a prioritized replacement program for hardware that cannot be patched. Budget for lifecycle refresh cycles and include security support timelines as procurement criteria.
• Strengthen logging, telemetry, and hunting capabilities so that successful exploitation is detected early and containment can be rapid.

---

What this means for WindowsForum readers and sysadmins​

• Check inventories today for the specific D‑Link and Array appliances noted. The Array fix is available — plan the upgrade now. For D‑Link Go‑RT‑AC750 devices, verify whether a vendor firmware release addresses the issue; if not, plan for isolation or replacement.
• If your environment relies on remote access appliances, treat this sort of KEV listing as a priority escalator: these are not abstract CVEs — they are vulnerabilities that threat actors have used to establish durable footholds.
• Use KEV additions as a trigger to run a short incident readiness checklist: validate backups, prepare maintenance windows, pre‑stage firmware updates, and ensure rollback plans are ready.

---

Caveats and verification note​

The technical descriptions and remediation guidance in this article are based on public vulnerability records, vendor advisories, and incident reports published by recognized vulnerability databases and incident response organizations. The KEV listing action and the exact date of CISA’s announcement are taken from CISA’s public advisory reporting; readers should verify the current KEV catalog entry and corresponding remediation deadlines directly in CISA’s KEV repository and vendor security bulletins, since KEV entries and timelines may be updated or refined after initial publication.
Where vendor support is absent or ambiguous, the recommended course (isolate and replace) reflects conservative, risk‑averse practice rather than a software patch; defenders must weigh operational constraints against security posture needs when deciding which option to pursue first.

---

Conclusion​

CISA’s decision to add CVE-2022-37055 and CVE-2025-66644 to the Known Exploited Vulnerabilities Catalog underscores two enduring truths of network defense: edge appliances and router management interfaces are high‑value targets, and attackers will continue to exploit legacy firmware and misconfigured management planes. The remediation paths are different — one vulnerability has a vendor‑provided upgrade route, while the other may fall to isolation and hardware replacement — but the operational takeaway is the same: prioritize discovery, limit network exposure, apply patches where available, and assume that any exposed management interface is a desirable target for adversaries. For federal agencies, KEV listings convert into binding remediation timelines; for all organizations, they should convert into action. Security teams that prepare to inventory, harden, and patch rapidly will reduce both the immediate risk and the operational fallout from these kinds of in‑the‑wild vulnerabilities.

---

Source: CISA CISA Adds Two Known Exploited Vulnerabilities to Catalog | CISA