D-Link has published mitigations for multiple unpatched security vulnerabilities affecting its DGS-3130 Series Managed Gigabit Stackable Switches. The company has not disclosed the flaws’ technical details or assigned CVE identifiers, but a researcher said they involve authentication, access control, and information processing in the D-Link Discovery Protocol (DDP). Successful exploitation could expose sensitive device data, enable unauthorized management changes, leak SNMP community strings, or disrupt or reset the device.
D-Link DGS-3130 switches affected
DGS-3130 Series switches provide multi-gigabit uplinks designed to reduce data bottlenecks in enterprise networks. They are primarily intended for small and medium-sized businesses (SMBs) and metro Ethernet deployments.
Giresh Kumar Enugu, a network engineer at Spectrum Community Solutions, reportedly discovered flaws involving the switches’ authentication and access-control mechanisms, as well as the processing of DDP information.
D-Link said the reported vulnerabilities affect DDP and specific components of the devices’ firmware security architecture.
“According to security researchers, successful exploitation of certain vulnerabilities could allow an attacker to access an affected network and obtain sensitive device information, perform unauthorized management operations, change device configurations, or disrupt network services.”
The company is continuing to investigate the impact on other D-Link switching platforms and firmware security mechanisms. Areas under review include SSH service security configuration, protection of credentials in the underlying operating system, and the handling of firmware encryption and embedded cryptographic keys.
D-Link recommends disabling DDP
Until updated firmware is available, D-Link has asked administrators to disable DDP to remove key known attack vectors. Administrators should also remove unnecessary or default SNMP community strings and restrict SSH, the Web UI, and SNMP access to isolated management networks and designated management hosts.
D-Link further advised customers to maintain offline backups of switch configurations and monitor device logs for unexpected configuration changes, unprompted reboots, or factory resets.
D-Link’s security advisory is available on the company’s security announcement page.
Earlier zero-day warning
In September, D-Link warned customers about a maximum-severity zero-day vulnerability tracked as CVE-2026-86296. The vulnerability affects the legacy DIR-822A dual-band Wi-Fi router, and a public proof-of-concept exploit is available while the flaw remains unpatched.
D-Link’s DGS-3130-30TS is among the products associated with the company’s ongoing investigation into the broader impact of the reported issues.
Source: www.bleepingcomputer.com