CISA KEV Alert: EOL D-Link and Array Networks Command Injection Under Active Attack

According to CISA KEV Alert cited by Daily CyberSecurity, two active threats have been added to the Known Exploited Vulnerabilities catalog: a critical flaw in legacy D-Link routers and a command injection vulnerability in Array Networks appliances, currently under attack in Japan. The D-Link issue, CVE-2022-37055, is a Buffer Overflow affecting Go-RT-AC750 devices, with a near-maximum CVSS of 9.8, and, as the affected hardware revisions have reached End of Life, D-Link advises retiring and replacing these devices.

The Array Networks flaw, CVE-2025-66644 (CVSS 7.2), targets ArrayOS AG and is being weaponised, with JPCERT/CC reporting attempts to place a PHP webshell at the path /ca/aproxy/webapp/. The bulletin notes attacks linked to the IP address 194.233.100.[.]138, used for both initial access and C2 communications, affecting ArrayOS AG version 9.4.5[.]8 and earlier with Desktop Direct enabled.

Administrators are urged to upgrade to version 9.4.5.9 or apply workarounds such as disabling Desktop Direct services or blocking URLs containing a semicolon, with a deadline of 29 December 2025 for FCEB agencies.