D-Link has warned of multiple unpatched security flaws in its DGS-3130 series of managed Gigabit stackable switches, and there is no firmware fix yet. The company published an interim security advisory on 6 November 2026, with mitigation steps for administrators.

The flaws were found by network engineer Giresh Kumar Enugu of Spectrum Community Solutions, who reported them to D-Link through a coordinated disclosure. They sit in the D-Link Discovery Protocol, known as DDP, which switches use to find and manage each other on a local network, covering authentication, access controls and information handling. The advisory also covers firmware security weaknesses, including SSH configuration, operating-system credential safeguards and firmware encryption.

An attacker with network access could read sensitive device information, change administrator credentials or settings, expose SNMP community information, and disrupt services or reset the switch. D-Link has not published CVE identifiers, so there is no standard reference for scanners and IT teams to track them against yet.

Disable the discovery protocol first

Until new firmware ships, D-Link asks administrators to disable DDP globally and on its interfaces, since that removes the primary known attack path. It also advises removing default or unnecessary SNMP community strings, restricting SSH, web and SNMP management access to isolated networks and designated admin hosts, keeping offline configuration backups and watching logs for unexpected changes, unprompted reboots or factory resets.

The flaws were demonstrated on a DGS-3130-30TS unit, hardware revision B1. D-Link says it is still investigating whether other DGS-3130 models and switching platforms are affected, and has not announced when corrective firmware will arrive. The warning follows a separate D-Link disclosure in September, when the company warned of a maximum-severity zero-day in its legacy DIR-822A routers, tracked as CVE-2026-86296, with a public proof-of-concept exploit and no patch.