D-Link DGS-3130: unpatched, disable DDP

D-Link told customers on November 6, 2026, that several unpatched flaws sit in the DGS-3130 series, its managed Gigabit stackable switches. The notice names no CVE identifiers and offers no firmware. Until a build ships, the vendor’s interim control is to turn off the D-Link Discovery Protocol, the component the researcher says carries the bugs.

Giresh Kumar Enugu, a network engineer at Spectrum Community Solutions, reported flaws in how those switches handle DDP authentication, access control, and device information. D-Link says an attacker who can reach the affected network may read sensitive device data, change credentials or configuration without authorization, or interrupt service. The public account of the impact also includes leaked SNMP community strings, disrupted switching, and device resets. The confirmed builds are multiple firmware versions of the DGS-3130-30TS. D-Link says it is still measuring the same issues on its other switching platforms, including how those products set SSH, protect operating-system credentials, and handle firmware encryption and embedded keys.

The DGS-3130 line is built for small and mid-sized networks and for metro Ethernet, with multi-gigabit uplinks meant to clear bottlenecks. A switch in that role is the path between floors, sites, or tenants. A configuration change or a reset on it is an outage, and a copied community string is a management secret that often gets reused on the next closet.

What D-Link has asked operators to change

Disable DDP. D-Link names that step as the way to remove the primary known path. Leave DDP off after the firmware arrives unless a documented workflow still requires it, and then only on a segment ordinary hosts cannot join.

Remove SNMP community strings that are defaults, unused, or shared with other devices. A string that left the switch in this bug is a string that should not open anything else. Restrict SSH, the web interface, and SNMP to an isolated management network and to named administrator hosts. A DGS-3130 whose management plane answers on the user VLAN is inside the conditions D-Link described.

Keep an offline copy of each switch configuration, taken from a trusted management host and stored somewhere the switch cannot reach. Watch logs and alerts for configuration changes nobody requested, reboots nobody scheduled, and factory resets. Those three are the traces D-Link told operators to hunt. A switch that rebooted itself overnight belongs in the incident queue even when traffic looks normal by morning.

Record the firmware string on every DGS-3130 now, before a patch exists, so the later change window has a before-and-after. When D-Link publishes identifiers, match them to that inventory. A ticket closed against a different D-Link advisory does not cover this one.

A different product, a different hole

In September, D-Link warned about CVE-2026-86296, a maximum-severity flaw in legacy DIR-822A dual-band routers, with a public demonstration and no patch for that end-of-life gear. That advisory is about a home router. This one is about DGS-3130 switches that are still in enterprise closets. Track them separately. Pulling old DIR-822A units does not mitigate a DGS-3130 that still speaks DDP.

D-Link has said the firmware work is unfinished and that other switch families are still under review. The action that is finished is the mitigation list: DDP off, SNMP communities reduced to ones you can name, management interfaces off the general network, configs stored offline, and a watch for resets you did not order. Apply that list to every DGS-3130-30TS you can find, and to any other D-Link switch that still has DDP enabled, until the vendor says which additional models are clear.

This briefing relies on public reporting by BleepingComputer and on D-Link’s advisory. It does not include exploit procedures.