D-Link says DGS-3130-30TS switches have unpatched discovery protocol and firmware flaws, with no fix date

TLDR

• D-Link says DGS-3130-30TS switches have unpatched discovery protocol and firmware flaws, and no fix date is confirmed.²
• Reported effects include leaked SNMP communities, changed credentials or configuration, and device resets or service disruption.¹²
• D-Link's main interim step is disabling DDP, which it says does not fix the separate firmware weaknesses.²

BleepingComputer reports that D-Link has shared mitigation measures for multiple unpatched security flaws in its DGS-3130 series managed Gigabit stackable switches.¹ D-Link's interim advisory, SAP10523, was published on 6 November 2026 at 12:16 GMT.² It says D-Link received a coordinated vulnerability disclosure on 2 November 2026 about flaws found during an independent security assessment of the DGS-3130-30TS managed switch, and that the researcher demonstrated exploitation through controlled testing.² D-Link credits Giresh Kumar Enugu of Spectrum Community Solutions.² The advisory says it was published before corrective firmware exists so customers can reduce exposure now, and that no firmware release date is confirmed.²

The advisory groups the findings into two sets. The first concerns the D-Link Discovery Protocol (DDP): weaknesses in authentication, access control and information handling, with potential impacts of unauthorised access to DDP administrative functions, disclosure of device and network configuration, unauthorised changes to administrative credentials, device resets or loss of configuration, and exposure of SNMP community information.² The second covers firmware security mechanisms: SSH service security configuration, protection of operating-system credentials, and firmware encryption and embedded cryptographic material.² D-Link says it is assessing these separately because disabling DDP does not by itself correct weaknesses elsewhere in the firmware.² It says several findings have been submitted for CVE assignment or have reserved identifiers, but the records are not yet public.² BleepingComputer adds that successful exploitation could let attackers obtain sensitive device data, make credential or configuration changes, leak SNMP communities, or cause service disruptions and device resets.¹

On scope, the advisory names hardware revision B1 of the DGS-3130-30TS as the product used in the researcher's confirmed testing, with firmware versions 2.00.B014, 2.00.B034, 2.04.000 and 2.04.001 examined, and says individual findings may apply to different subsets of those versions.² Other DGS-3130 models and other D-Link switching platforms are listed as under investigation with impact not yet confirmed, and D-Link says including them does not establish that they are vulnerable.² BleepingComputer's headline refers to DGS-3130 Series switches and SC Media's to DGS-3130 switches, while both texts say the flaws affect firmware versions of the DGS-3130-30TS model.¹³ On identifiers, BleepingComputer says D-Link has yet to publicly disclose CVE IDs, SC Media says D-Link has not yet assigned them, and the advisory says identifiers are submitted or reserved but not public.¹²³ BleepingComputer calls the flaws zero-days, a term the D-Link advisory does not use.¹² BleepingComputer also notes that in September D-Link warned of a maximum-severity zero-day, CVE-2026-86296, in legacy DIR-822A routers, with a public proof-of-concept exploit and no patch.¹

D-Link's primary recommendation is to disable DDP globally and on applicable interfaces with the no ddp command, and the advisory says the researcher reported that this stopped the tested DDP attack vectors from being processed, a result D-Link is still reviewing independently.² It warns that disabling DDP may affect discovery or management workflows, and that customers should not rely only on the switch's management access-control settings or VLAN separation against the DDP issues.² It also advises removing default or unnecessary SNMP community strings such as public and private, restricting SSH, web and SNMP management to designated hosts and not exposing them to the public internet, keeping configuration backups, and watching for unexpected restarts, configuration changes or factory resets.² On exploitation, Hunter Strategy says the report does not establish active exploitation and that exploit availability and attack activity remain open questions, and Matrice Digitale says the advisory does not confirm exploitation in real attacks.⁴⁵

Why it matters: D-Link says disabling DDP does not correct the firmware weaknesses it is still assessing, so affected customers have only interim configuration steps until firmware arrives, and no release date is confirmed.²