D-Link DGS-3130 Switches Have Unpatched DDP Flaws

D-Link has warned that its DGS-3130 series managed switches carry several unpatched security flaws, and it has published mitigations while it works on firmware. BleepingComputer reported the advisory on November 6. No CVE IDs have been published yet, so there is nothing to look up in NVD or match against a scanner.

What D-Link has said

According to D-Link, the bugs were found by Giresh Kumar Enugu, a network engineer at Spectrum Community Solutions. They involve the D-Link Discovery Protocol (DDP), covering authentication, access control and information handling, and certain parts of the firmware’s security design.

D-Link says an attacker with access to the affected network could obtain sensitive device information, make unauthorized administrative changes, alter configuration, leak SNMP community strings, or disrupt service, including resetting the device. The company has not shared technical detail, and this article does not try to fill the gap.

The flaws affect multiple firmware versions on the DGS-3130-30TS. D-Link is still investigating other switching platforms, along with SSH configuration security, protection of operating-system credentials, and firmware encryption and embedded keys. Treat the affected list as incomplete for now.

What to do until firmware ships

D-Link’s mitigations, as reported:

• Disable DDP, which the company describes as the primary known attack vector.
• Remove unnecessary or default SNMP community strings.
• Restrict SSH, the web interface and SNMP to isolated management networks and designated admin hosts.
• Keep offline backups of switch configurations.
• Watch device logs for unexpected configuration changes, unprompted reboots or factory resets.

Analysis

The attack described needs network access, which makes management-plane isolation the control that matters most here. A switch that only answers on a dedicated management VLAN is a much smaller problem than one reachable from user segments. Nothing in the source says these flaws are exploited, and no public exploit is mentioned.

This is the second time since September that D-Link has told customers about an unpatched problem. The earlier case, a maximum-severity DIR-822A flaw with no fix, affected legacy routers. Different product class, same position for the owner: mitigate now, wait for the vendor.

More on the vendor is on the D-Link topic page.