D-Link warns of unpatched flaws in DGS-3130 switches, offers mitigations only

D-Link has put out mitigation advice for several unpatched flaws in its DGS-3130 series managed Gigabit stackable switches, according to a BleepingComputer report published on November 6, 2026. There's no firmware fix yet, and D-Link hasn't published CVE IDs, which makes tracking the bugs harder than it needs to be.

The company says Spectrum Community Solutions network engineer Giresh Kumar Enugu found the bugs in the D-Link Discovery Protocol (DDP) authentication, access control and information handling, plus what D-Link describes as certain components of the device's firmware security architecture. D-Link's own wording is that exploitation "may" let an attacker with access to the affected network pull sensitive device information, carry out unauthorized administrative operations, change configuration or disrupt network services. The report adds that leaked SNMP communities and device resets are among the possible outcomes.

The flaws affect multiple DGS-3130-30TS firmware versions. D-Link says it's still looking at other switching platforms and at how the firmware handles SSH configuration, operating-system credentials and encryption keys.

Until new firmware lands, D-Link asks admins to turn off DDP, which it calls the primary known attack vector, drop unnecessary or default SNMP community strings, and limit SSH, web UI and SNMP to isolated management networks and named admin hosts. It also suggests keeping offline configuration backups and watching logs for configuration changes, reboots or factory resets nobody asked for.

We'd treat the missing CVE IDs as a reason to check the model list yourself rather than wait for a scanner to flag it. Whether other D-Link switch families are affected is still open.