D-Link published an interim security advisory today, November 6, 2026, warning that multiple unpatched vulnerabilities hit its DGS-3130-30TS managed Gigabit stackable switches, with other DGS-3130 models and even other switching platforms still under investigation. The bugs, found by Spectrum Community Solutions network engineer Giresh Kumar Enugu, sit in the D-Link Discovery Protocol (DDP) and in broader firmware security pieces such as SSH hardening, OS credential protection and firmware crypto material. There is no corrective firmware yet and no public CVE IDs. Successful exploitation on the assessed hardware can yield sensitive device data, unauthorized admin changes, SNMP community leakage, service disruption or device resets. Here’s what D-Link confirmed, which boxes to check first, and the mitigations to apply before a patch exists.
What D-Link Confirmed in SAP10523
Publication SAP10523 says D-Link received the coordinated disclosure on November 2 and is releasing guidance before a fix is ready so customers can shrink exposure now. Confirmed testing was on the DGS-3130-30TS hardware revision B1 running firmware versions including 2.00.B014, 2.00.B034, 2.04.000 and 2.04.001. Individual findings may apply to different subsets of those builds. Other DGS-3130 models and other D-Link switching platforms are explicitly “under investigation,” which means inventory should not stop at the 30TS SKU.
D-Link groups the issues into DDP weaknesses—authentication, access control and information handling—and separate firmware-security findings that disabling DDP will not automatically fix. CVE records are reserved or submitted but not yet public; D-Link says it will update the advisory as identifiers and impact land.
Why SMB and Metro Ethernet Shops Should Care
The DGS-3130 line is aimed at small-to-medium businesses and metro Ethernet builds that want multi-gig uplinks without jumping to a full chassis. Those are exactly the environments where discovery protocols get left on, SNMP still carries public and private communities, and management VLANs are more wishful thinking than enforced policy. An attacker who already has a foothold on the LAN—or who can reach a poorly segmented management segment—does not need a flashy remote WAN exploit to make a switch very unhappy.
Interim Mitigations: Do These Before the Firmware Lands
D-Link’s own priority list, which lines up with BleepingComputer’s write-up of the advisory, is clear:
- Disable DDP now: turn it off globally and on applicable interfaces. On the DGS-3130 CLI that is the no ddp command in global and interface configuration modes. Verify with the switch’s show-ddp style commands, then save and confirm the setting survives a reload. The researcher reported that full DDP disable blocked the tested DDP attack paths
- Strip default SNMP communities: remove unnecessary strings, especially the classic public and private communities, and move required monitoring to properly secured SNMPv3 with auth and privacy where the firmware supports it
- Lock the management plane: restrict SSH, the web UI and SNMP to designated admin hosts and an isolated management network. Do not expose those services to the public internet. D-Link also warns not to trust management ACLs or VLAN separation alone against the reported DDP issues
- Backup and watch: keep offline configuration backups, review admin credentials, and alert on unexpected reboots, config changes, interface shutdowns or factory resets
- Stay glued to the advisory: no firmware release date is published. Treat the interim steps as mandatory until D-Link names a fixed build for your exact model and hardware revision
What This Does Not Fix Yet
Disabling DDP is the primary interim move for the discovery-protocol findings, but D-Link is explicit that it does not correct the separate firmware-security issues around SSH configuration, OS credential protection and embedded cryptographic material. Those will need a validated firmware release after engineering review. Until then, shrinking management exposure and monitoring for tampering is the realistic containment plan.
Looking Ahead
Watch SAP10523 for CVE assignments, expanded model lists and the first fixed firmware. When that build appears, match it to the exact hardware revision on the product label before you flash anything—D-Link firmware is revision-specific. Given the company’s September warning about an unpatched max-severity flaw in legacy DIR-822A routers, expecting fast, clean follow-through on DGS-3130 is hopeful rather than guaranteed, so the CLI mitigations matter more than the promise of a future patch.
For MSPs and internal network teams, today’s job is inventory and harden: find every DGS-3130, kill DDP, clean SNMP, and pull management off user VLANs. The research already demonstrated exploitation in controlled testing. Waiting for CVEs before acting is how closet switches become the quietest pivot on the network.
Sources:
- D-Link Security Announcement SAP10523, November 6, 2026
- BleepingComputer, November 6, 2026
- OSINTSights, November 6, 2026
