D-Link confirms multiple zero-days in DGS-3130 switches, no fix yet
D-Link's SAP10523 advisory confirms unpatched DDP and firmware flaws in DGS-3130-30TS managed switches. No CVE IDs are public and no corrective firmware is scheduled.
D-Link has confirmed multiple unpatched vulnerabilities in its DGS-3130 Series managed switches. The interim advisory, SAP10523, published November 6, says there is no corrective firmware yet and "no release schedule has been confirmed." If you run these switches on a reachable management network, the mitigation work is manual and it is on you today.
The flaws were reported through coordinated disclosure on November 2 by Giresh Kumar Enugu, a network engineer at Spectrum Community Solutions, and confirmed by D-Link four days later (BleepingComputer).
What's affected
- Confirmed on the DGS-3130-30TS, hardware revision B1 — the model and revision the researcher tested.
- Firmware builds examined: 2.00.B014, 2.00.B034, 2.04.000, 2.04.001. D-Link notes individual findings may apply to only some of these.
- Other DGS-3130 models and other D-Link switching platforms are listed as under investigation, impact not confirmed.
What the bugs do
D-Link groups the findings into two buckets:
- D-Link Discovery Protocol (DDP). Weaknesses in authentication, access control, and information handling. Possible impact: unauthorized access to DDP admin functions, disclosure of device and network configuration, unauthorized changes to admin credentials, device resets or service disruption, and exposure of SNMP community strings.
- Firmware. Issues with the SSH service configuration, protection of operating-system credentials, and firmware encryption and embedded cryptographic material.
No CVE IDs yet
D-Link has not published CVE IDs. The advisory says some findings have been submitted for assignment or hold reserved identifiers, but the records are not public. We will not assign numbers that don't exist — treat the vendor advisory as the reference until the CVEs land.
No proof-of-concept has been released, and neither D-Link nor the reporting outlet reports exploitation in the wild.
Action checklist
- Disable DDP globally and on affected interfaces:
no ddp, then verify and save the running config. D-Link is explicit that this does not fix the firmware issues — it only closes the DDP surface. - Remove default SNMP communities (
public,private) and any other unnecessary strings. Where SNMP is required, move to SNMPv3 with authentication and privacy. - Restrict SSH, web UI, and SNMP to an isolated management network; disable management services you don't use.
- Keep verified, offline configuration backups.
- Monitor logs for unexpected configuration changes, reboots, or factory resets, and watch for the DDP admin operations described above.
- Track SAP10523 for firmware — the advisory is marked "Resolved: Partial," so expect updates as D-Link assesses the rest of the line.
Context
This is a vendor confirming live flaws before it has a patch — the "interim announcement" pattern D-Link has used before for switch and router issues. The management-plane exposure matters more than the raw count: DDP and SNMP are exactly the services that get left reachable on flat management VLANs, and a switch that can be reset or have its admin credentials rewritten is a foothold into everything downstream of it. Segment the management network now; it's the mitigation that survives whatever the CVEs turn out to be.