GoKawiilD-Link issues mitigations for unpatched zero-days in DGS-3130 switches
D-Link has published workarounds for several unpatched vulnerabilities in its DGS-3130 series managed Gigabit stackable switches, discovered by researcher Giresh Kumar Enugu. The flaws involve the D-Link Discovery Protocol and firmware security components, potentially letting attackers read sensitive device data, alter configurations, leak SNMP community strings, or disrupt service. No CVE numbers have been assigned yet, and D-Link is still assessing whether other switch models and firmware are affected.
GoKawiil's interpretation of the reporting above, not reported fact.
Because these switches serve SMB and metro Ethernet networks, unpatched flaws in device discovery and firmware security could let attackers pivot into broader network infrastructure before a fix exists. The lack of CVE identifiers and a patch timeline means administrators must rely on manual mitigations like disabling DDP and restricting management access, which suggests exposure could persist for some time.
- D-Link's DGS-3130-30TS switches have multiple unpatched zero-day vulnerabilities affecting DDP and firmware security.
- Exploitation could expose sensitive data, allow configuration changes, leak SNMP strings, or disrupt network services.
- D-Link recommends disabling DDP, removing unused SNMP strings, and restricting SSH/web UI access until a firmware fix is released.
Source: bleepingcomputer.com, 2026-11-06
Published there as: “D-Link warns of multiple zero-days in DGS-3130 Series switches”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.