D-Link has published an interim security advisory for multiple unpatched vulnerabilities in its DGS-3130 series of managed stackable gigabit switches, which BleepingComputer describes as aimed at small and medium businesses and metro Ethernet deployments. D-Link says it received a coordinated disclosure on November 2 from an independent security assessment of the DGS-3130-30TS, which BleepingComputer attributes to Spectrum Community Solutions network engineer Giresh Kumar Enugu. The advisory says no corrective firmware has been released and there is no confirmed release date. The CVE records have been submitted or reserved but are not yet public, so there are no CVE ids to track.
The first group of flaws concerns the D-Link Discovery Protocol (DDP): weaknesses in authentication, access control and information handling. D-Link says the potential impact includes unauthorized access to DDP administrative functions, disclosure of device and network configuration, unauthorized changes to administrative credentials, device resets or loss of configuration, and exposure of SNMP community information. A second group concerns firmware security mechanisms, including SSH service security configuration, protection of operating-system credentials, and protection of firmware encryption and embedded cryptographic material. D-Link says the DDP workaround does not correct these, and it is assessing them separately. The company says the researcher demonstrated exploitation in controlled testing, and that an attacker would need access to the affected network. It does not say any attacks have been seen.
D-Link warned in September of a separate maximum-severity, unpatched flaw in the legacy DIR-822A router, covered in D-Link DIR-822A Router Has a Max-Severity Zero-Day With No Patch.
How to check if you’re affected
Affected products per D-Link’s advisory are the DGS-3130-30TS, hardware revision B1. The researcher examined firmware versions 2.00.B014, 2.00.B034, 2.04.000 and 2.04.001, and D-Link notes that individual findings may apply to different subsets of these versions. Other DGS-3130 models and other D-Link switching platforms are under investigation, with impact not yet confirmed; being listed there does not mean they are vulnerable.
D-Link’s recommended interim steps, to apply without waiting for firmware:
- Disable DDP globally and on applicable switch interfaces. The advisory says the DGS-3130 CLI supports
no ddpin both global and interface configuration mode; verify the result with theshow ddpcommands, save the configuration, and confirm it persists after a restart. The researcher reported that this stopped the tested DDP attacks, and D-Link is independently reviewing the mitigation. Disabling DDP may affect discovery or management workflows that rely on it. - Remove unnecessary or default SNMP community strings, especially
publicandprivate(no snmp-server community public,no snmp-server community private; check the syntax for your firmware). Where SNMP is needed, D-Link recommends SNMPv3 with authentication and privacy, limited to authorized hosts. Removing the strings does not fix the DDP information disclosure by itself. - Restrict SSH, web management and SNMP to designated management systems, keep management services off the public internet, and do not rely only on the switch’s management access-control settings or VLAN separation, which D-Link says the researcher’s findings show are not sufficient for the DDP issue.
- Keep verified configuration backups, and watch for unexpected restarts, configuration changes, interface shutdowns and factory resets. If you suspect unauthorized access, follow your incident-response procedures.
D-Link says it will update the advisory with CVE ids and confirmed impact as disclosure coordination continues, and to watch for the firmware update.