D-Link has published mitigations for several unpatched flaws in its DGS-3130 series managed switches, a line the vendor positions for small and medium businesses. There is no firmware fix yet and no public CVE identifiers.

What happened

D-Link's advisory, SAP10523, places the bugs in the D-Link Discovery Protocol, covering authentication, access control and how the switch handles device information, along with parts of the firmware security architecture. The company credits network engineer Giresh Kumar Enugu of Spectrum Community Solutions with the findings.

Successful exploitation would let someone who already has a foothold on the same network read sensitive device information, make unauthorised administrative or configuration changes, leak SNMP community strings, or push the switch into service disruption and resets. D-Link says the flaws affect multiple DGS-3130-30TS firmware versions and that it is still assessing other switch platforms and firmware mechanisms, including SSH service configuration and how credentials and embedded cryptographic keys are handled.

Who is affected

• Networks running DGS-3130 series managed stackable switches. D-Link confirmed the DGS-3130-30TS and is still checking the rest of the family.
• Sites where staff workstations or guest devices can reach the switch management interface, which is the normal arrangement in a small office rather than the exception.
• Anyone still running default or unused SNMP community strings on network gear.

What to do now

Disable DDP on every DGS-3130. D-Link names it as the primary known attack path, and no firmware update exists to fall back on.

• Remove unused and default SNMP community strings, and move to SNMPv3 where the monitoring platform supports it.
• Restrict SSH, the web interface and SNMP to an isolated management network and named admin hosts, so an office PC cannot reach the switch's login page at all.
• Keep an offline copy of each switch configuration, and watch logs for unexpected config changes, unprompted reboots or factory resets.
• Track D-Link's support page and patch once firmware ships. Until then the mitigations are the whole control set.

What this means for South African businesses

In most South African SMEs the management plane of the switching sits on the same flat VLAN as the staff laptops, so "attacker with access to the affected network" is a lower bar than it sounds after any single workstation infection. These flaws are not remotely exploitable from the internet and no exploitation has been reported, which makes this a hardening job rather than an emergency, but it will not be fixed by waiting for a patch that D-Link has not committed to a date for. The vendor advisory is at D-Link SAP10523.

Also on the blog

• SonicWall CVE-2026-19868: SAML bypass skips MFA on SSL-VPN logins and is already exploited
• NightsBridge breach: 10,000-property SA booking platform hit by AI-driven attack

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.