D-Link Disclosed Zero-Days in DGS-3130 Switches With No Patch and No CVE Yet. Turn Off the D-Link Discovery Protocol, Then Look at Who Can Reach the Management Interface.
If you run D-Link DGS-3130 switches, disable the D-Link Discovery Protocol (DDP) on them today and limit management access to an isolated network, because D-Link has disclosed multiple zero-day flaws and has no firmware fix yet. BleepingComputer reported the warning on November 6, 2026, citing D-Link support announcement SAP10523. D-Link does not say anyone is attacking these switches.
What is reported
D-Link says the flaws sit in DDP and in "certain components of the device's firmware security architecture." It describes the DDP problems as authentication, access control and information handling. It calls DDP the primary known attack vector. The zero-days affect multiple DGS-3130-30TS firmware versions, and the article lists no version numbers.
According to the report, an attacker could obtain sensitive device data, change credentials or configuration without authorization, leak SNMP community strings, and disrupt service or reset the device. D-Link is still investigating whether other switching platforms are affected, including areas such as SSH configuration, operating-system credential safeguards, and firmware encryption and embedded cryptographic keys.
The researcher credited is Giresh Kumar Enugu, a network engineer at Spectrum Community Solutions.
What D-Link says to do until firmware ships
- Disable DDP.
- Remove unnecessary or default SNMP community strings.
- Restrict SSH, web interface and SNMP access to an isolated management network and designated administrator hosts.
- Keep offline backups of switch configurations.
- Watch logs for unexpected configuration changes, unprompted reboots or factory resets.
An SNMP community string works like a shared password. Leaking one on a switch can expose the configuration of everything it manages, so changing them is worth doing even if you do not run these models.
What is not stated
The article does not give CVE IDs, a CVSS score, a count of flaws, firmware versions, a patch date, an end-of-life status, proof-of-concept availability, indicators of compromise or any report of exploitation. Treat the lack of an exploitation report as a statement about what was published, not as evidence that nobody has tried. Switches are rarely monitored the way servers are, so compromise could go unseen.
The article also points to a September D-Link warning about a different product, the DIR-822A (CVE-2026-86296). We did not read that advisory.
What to check this week
These steps are ours, not D-Link's.
- Find your DGS-3130 units, including ones in closets nobody inventories, and check which firmware each runs against announcement SAP10523.
- Confirm whether the management interface is reachable from anywhere other than an admin network. If you can reach it from a normal user segment, so can anything that lands there.
- After you disable DDP, check that nothing you rely on, such as discovery tools, needed it.
- Rotate SNMP community strings if the switch ever answered the defaults, and store the new ones outside the switch.
Indicators
None were published, so nothing was added to the feed.
Limits
We read BleepingComputer's report of D-Link's announcement. We did not read SAP10523 directly, test any device, or confirm that other D-Link models are unaffected.
Five percent of this is wrong somewhere. It always is. When D-Link assigns CVE IDs and versions, this list will need them.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.