- \n
- The confirmed affected model is the DGS-3130-30TS, hardware revision B1<\/strong>, on firmware 2.00.B014, 2.00.B034, 2.04.000 and 2.04.001.<\/li>\n
- Other DGS-3130 models and other D-Link switches are still being investigated.<\/li>\n
- There is no patched firmware and no release date yet.<\/li>\n
- D-Link\u2019s top advice is to disable the D-Link Discovery Protocol (DDP)<\/strong>, remove default SNMP communities and lock down management access.<\/li>\n
- No attacks using these flaws have been reported so far.<\/li>\n<\/ul>\n
![\"Ethernet](\"https:\/\/mosravo.com\/publications\/wp-content\/uploads\/2026\/11\/5339417741_6a54da4db7_b.jpg\")
Photo: \u201cEthernet Cable\u201d by David Davies, CC BY-SA 2.0, via Openverse<\/figcaption><\/figure>\n What D-Link disclosed<\/h2>\n
According to D-Link\u2019s advisory (SAP10523), the company received a coordinated disclosure on 2 November 2026 from Giresh Kumar Enugu, a network engineer at Spectrum Community Solutions. D-Link lists the resolution status as \u201cpartial\u201d because it is still assessing how far the problems reach.<\/p>\n
Problems in the D-Link Discovery Protocol<\/h3>\n
The first group of issues sits in DDP, a protocol D-Link devices use to find and manage each other on a network. D-Link describes weaknesses in authentication, access control and how the protocol handles information. An attacker who can reach the switch on the network could potentially:<\/p>\n
- \n
- gain unauthorised administrative access or change admin credentials;<\/li>\n
- read device and network configuration details;<\/li>\n
- expose SNMP community information, which is often used by monitoring tools;<\/li>\n
- reset the device or disrupt service.<\/li>\n<\/ul>\n
Firmware security concerns<\/h3>\n
The second group concerns the firmware itself: SSH configuration, how operating-system credentials are protected, and how firmware encryption and embedded cryptographic material are handled. D-Link is clear that switching off DDP does not<\/strong> fix these firmware issues. Some findings have CVE identifiers reserved, but the records are not public yet, as BleepingComputer also reported.<\/p>\n
Who is affected<\/h2>\n
The DGS-3130 is a family of managed Gigabit stackable switches, the kind found in server rooms, school networks, hospitals, hotels and growing offices. In many organisations, switches like these are installed once by a contractor and then rarely touched, which makes interim mitigations easy to overlook. If you are not sure what model you have, check the label on the device or the system information page in its management interface, and note the hardware revision as well as the firmware version.<\/p>\n
According to D-Link, the attacker needs access to the affected network. That lowers the risk for well-segmented networks, but a single infected PC or a guest device on the same network segment could be enough, and any switch with its management interface exposed to the internet is at higher risk.<\/p>\n
D-Link\u2019s interim mitigations, step by step<\/h2>\n
- \n
- Disable DDP immediately.<\/strong> In the switch command line, run no ddp<\/em> in global configuration mode and in interface configuration mode, check the result with show ddp<\/em>, and save the configuration. D-Link warns this may affect device discovery or management workflows.<\/li>\n
- Remove default SNMP communities.<\/strong> Delete \u201cpublic\u201d, \u201cprivate\u201d and any other unneeded community strings. Where supported, use SNMPv3 with authentication and privacy, and allow SNMP only from authorised hosts.<\/li>\n
- Restrict management access.<\/strong> Limit SSH, web and SNMP management to designated admin machines, keep management interfaces off the public internet, and enforce this with firewall rules. D-Link advises not to rely only on the switch\u2019s own access lists or on VLAN separation.<\/li>\n
- Back up and monitor.<\/strong> Keep verified offline configuration backups, review admin accounts, and watch logs for unexpected restarts, configuration changes, interface shutdowns or factory resets.<\/li>\n
- Watch for firmware.<\/strong> Check D-Link\u2019s security announcements regularly. Before installing any future update, confirm the exact model and hardware revision, because firmware may not be compatible across revisions.<\/li>\n<\/ol>\n
Context: D-Link\u2019s recent run of advisories<\/h2>\n
BleepingComputer notes that in September D-Link warned of a separate maximum-severity zero-day in legacy DIR-822A routers, which has a public proof-of-concept exploit. That issue affected older consumer routers, while this one involves business switches, and D-Link says it will update its advisory as it verifies more information. Either way, the pattern is a reminder that network gear deserves the same patch attention as laptops and servers.<\/p>\n
Why switches are attractive targets<\/h3>\n
A managed switch sits at the heart of a network. An attacker who controls one could change its configuration or knock part of a network offline. Because switches rarely run security software and are seldom monitored, problems can go unnoticed for a long time.<\/p>\n
What you should do<\/h2>\n
- \n
- Inventory your D-Link switches today and note the model, hardware revision and firmware version of each.<\/li>\n
- For any DGS-3130 device, disable DDP and save the configuration, testing first if your team relies on D-Link discovery tools.<\/li>\n
- Remove \u201cpublic\u201d and \u201cprivate\u201d SNMP communities and move to SNMPv3 where possible.<\/li>\n
- Make sure no switch management page is reachable from the internet; put management on a separate admin network.<\/li>\n
- Take a fresh configuration backup and store it offline.<\/li>\n
- If you use an IT contractor or managed service provider, forward them D-Link advisory SAP10523 and ask them to confirm the mitigations in writing.<\/li>\n
- Check back for firmware and install it promptly once released.<\/li>\n<\/ul>\n
Sources<\/h3>\n
- Remove default SNMP communities.<\/strong> Delete \u201cpublic\u201d, \u201cprivate\u201d and any other unneeded community strings. Where supported, use SNMPv3 with authentication and privacy, and allow SNMP only from authorised hosts.<\/li>\n
- Disable DDP immediately.<\/strong> In the switch command line, run no ddp<\/em> in global configuration mode and in interface configuration mode, check the result with show ddp<\/em>, and save the configuration. D-Link warns this may affect device discovery or management workflows.<\/li>\n