D-Link published an interim advisory on 6 November 2026 for several unpatched vulnerabilities in its DGS-3130 series managed switches, and there is no fixed firmware yet. The flaws were reported through coordinated disclosure four days earlier and confirmed on the DGS-3130-30TS, hardware revision B1.
What happened
The findings sit in two groups. The first covers the D-Link Discovery Protocol: weaknesses in authentication, access control and information handling that could let someone on the network reach DDP administrative functions, read device and network configuration, change administrative credentials, leak SNMP community strings, or reset the device and wipe its configuration. The second group covers firmware security mechanisms, including SSH service configuration, protection of operating system credentials, and firmware encryption and embedded cryptographic material. Disabling DDP does not fix that second group.
D-Link says the researcher demonstrated the issues in controlled testing and that exploitation requires access to the affected network. It has not reported attacks in the wild, has not published technical detail, and has not released CVE identifiers, though it says some records are reserved or submitted. No firmware release schedule has been confirmed.
Who is affected
- DGS-3130-30TS switches on hardware revision B1, the platform the researcher tested
- Firmware builds examined include 2.00.B014, 2.00.B034, 2.04.000 and 2.04.001, and individual findings may apply to only some of them
- Other DGS-3130 models and other D-Link switching platforms are under investigation, with impact not confirmed, so the affected list is likely incomplete
- Any site where the switch management plane is reachable from user segments, guest Wi-Fi or the internet
What to do now
Disable DDP globally and on affected interfaces before you wait for a patch, and move management access onto an isolated network.
- Run
no ddpin global and interface configuration, confirm the state with the show commands, save, and verify the setting survives a reload. - Remove default and unused SNMP community strings, especially public and private, and move required monitoring to SNMPv3 with authentication and privacy.
- Restrict SSH, the web interface and SNMP to designated management hosts on a dedicated management network, and keep them off the public internet.
- Take a verified offline backup of the switch configuration and alert on unexpected reboots, interface shutdowns, configuration changes or factory resets.
What this means for South African businesses
Access switches rarely get firmware attention in a South African SME, because they sit in a cabinet and nobody reboots them, and D-Link is common in exactly that tier of network. The exposure here is not the internet, it is a compromised workstation or an unpatched camera VLAN that can reach the switch management interface. In my experience a management VLAN that is documented but not enforced at the port level is the norm rather than the exception, so the isolation step is worth testing rather than assuming.
Source: BleepingComputer report on D-Link advisory SAP10523.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.