D-Link DGS-3130 zero-days: SAP10523 has no patch yet, what to do

D-Link has published an interim security advisory (SAP10523) for the DGS-3130-30TS managed switch, listing several vulnerabilities for which there is no firmware fix and no confirmed release date. The flaws sit in the D-Link Discovery Protocol (DDP) and in parts of the firmware's security design. D-Link has not yet published CVE identifiers or a severity score, so for now the advisory is the only authoritative reference. If you run these switches, the practical step is to apply D-Link's interim mitigations today rather than wait for a patch.

Key points

• D-Link published advisory SAP10523 on 6 November 2026 (12:16 GMT) for the DGS-3130-30TS, hardware revision B1; its status is "Partial" resolved.
• D-Link received the coordinated disclosure on 2 November 2026 from Giresh Kumar Enugu of Spectrum Community Solutions, and says the researcher demonstrated exploitation in controlled testing.
• The flaws involve DDP authentication, access control and information handling, plus SSH configuration, operating-system credential protection and firmware encryption and embedded key material.
• No corrective firmware exists and D-Link says no confirmed firmware release date is available. No CVE records or CVSS scores are public yet.
• The main interim mitigation is the CLI command no ddp, but D-Link says it does not fix the firmware-level findings.

What to do

Who is affected. D-Link lists the DGS-3130-30TS, hardware revision B1, with firmware 2.00.B014, 2.00.B034, 2.04.000 and 2.04.001 examined. Other DGS-3130 models and other D-Link switching platforms are "under investigation"; D-Link states that being investigated does not mean they are vulnerable. Individual findings may apply to different subsets of the four firmware versions.

What D-Link tells customers to do now (all from the advisory):

1. Disable DDP globally and on each applicable interface with no ddp in global and interface configuration mode, check the result with the show ddp commands, save the configuration, and confirm the setting survives a restart. The researcher reported this blocked the DDP attack vectors that were tested, and D-Link is still reviewing that. It may break discovery or management workflows that rely on DDP.
2. Remove the default SNMP communities public (typically read-only) and private (typically read-write), for example with no snmp-server community public and no snmp-server community private; D-Link asks you to verify the syntax for your firmware. Where SNMP is needed, use SNMPv3 with authentication and privacy and restrict it to authorised hosts. This does not fix the DDP information-disclosure problem.
3. Keep SSH, web and SNMP management on a restricted management network, off the public internet, behind firewall rules. D-Link warns not to rely only on the switch's own access controls or VLAN separation, based on the researcher's findings.
4. Keep verified configuration backups, review administrator credentials, and watch for unexpected restarts, configuration changes, interface shutdowns and factory resets. If you suspect compromise, follow your incident-response process.
5. Do not install firmware assuming it fixes these issues. D-Link says to check the exact model and hardware revision, and not to assume an existing release is a fix unless D-Link says so.

How to check whether you are affected. Look up the model and hardware revision on the label or in the switch's system information, and compare the running firmware with the four versions above. Check the DDP state with the show ddp commands the advisory names, and list configured SNMP communities in the running configuration.

What happened

D-Link says it received a coordinated vulnerability disclosure on 2 November 2026 about problems found during an independent security assessment of the DGS-3130-30TS. Four days later, on 6 November, it published an "interim" advisory before any fix was ready, saying it did so "so customers can take immediate action to reduce potential exposure". The advisory was first published at 12:16 GMT and updated at 12:30 GMT the same day.

According to the advisory, the researcher says an attacker with access to the affected network could obtain sensitive device information, carry out unauthorised administrative operations, change configuration or disrupt network service. The listed DDP impacts are unauthorised access to DDP administrative functions, disclosure of device and network configuration, unauthorised changes to administrative credentials, device resets or configuration loss, and exposure of SNMP community information. BleepingComputer, which reported the advisory the same morning, notes that D-Link gave no technical detail on the flaws.

The second group of findings is separate. D-Link says it is evaluating the SSH service security configuration, the protection of operating-system credentials, and the protection of firmware encryption and embedded cryptographic material independently, "because disabling DDP does not, by itself, correct weaknesses elsewhere in the firmware".

Why the details matter

Two things in the wording are easy to miss. First, the advisory describes an attacker "with access to the affected network". That points to adjacency, not to a bug exploitable from anywhere on the internet, but D-Link is explicit that VLAN separation and the switch's access controls should not be treated as sufficient. On a flat or poorly segmented network, anything that can reach the switch is in scope.

Second, the mitigation is incomplete by design. Turning off DDP removes the vector the researcher tested, but D-Link treats the firmware-level findings as a separate problem that the command does not touch. Administrators who disable DDP and move on will still have switches with the SSH, credential and key-protection issues D-Link has promised to investigate.

Background

The DGS-3130 series is a line of managed, stackable Gigabit switches. BleepingComputer describes them as aimed at small and medium businesses and metro Ethernet deployments, with multi-gigabit uplinks. D-Link's own advisory covers only the 30-port DGS-3130-30TS, revision B1, as the confirmed test platform.

This is not the first time D-Link has published guidance for an unpatched flaw this year. BleepingComputer recalls that in September D-Link warned customers about a maximum-severity zero-day, tracked as CVE-2026-86296, in legacy DIR-822A dual-band Wi-Fi routers, with a public proof-of-concept exploit and no patch. That is a different product line and a different bug, but it shows the pattern: for older or niche hardware the vendor's first public message can be a workaround list rather than a fix.

Network switches are a recurring target, which is why advisories like this are worth acting on quickly. We recently covered another switch case: a Zyxel GS1900 flaw that bypassed a June patch. BleepingComputer's headline on the D-Link story calls the flaws "zero-days", meaning unpatched at disclosure. D-Link's own advisory does not say they are being exploited, and we have seen no report of exploitation.

What it means

For small businesses and managed-service providers running these switches, the immediate cost is operational: disabling DDP can break automatic discovery in tools that depend on it, so test on a non-critical device first. The larger cost is uncertainty. Without CVE IDs or CVSS scores, vulnerability scanners and ticketing systems will not flag the problem, so teams relying on automated feeds will not hear about it. Someone has to add the advisory to the asset register by hand.

For D-Link, publishing before a fix is the right call in terms of transparency, and the advisory is unusually specific about CLI commands and what each step does and does not cover. The open question is how quickly corrective firmware follows, and whether the "other DGS-3130 models" and "other switching platforms" investigations widen the list.

What we don't know yet

• Which CVE identifiers will be assigned, and their severity scores. D-Link says some are submitted or reserved but not public.
• Whether other DGS-3130 models, hardware revisions or other D-Link switch families are affected. D-Link says impact is not confirmed.
• Whether any of the flaws needs authentication or can be reached without it. The advisory does not say.
• When corrective firmware will ship. D-Link says no confirmed firmware release date is available.
• Whether anyone is exploiting the flaws. Neither the advisory nor BleepingComputer's report says they are.

What to watch next

• Updates to D-Link advisory SAP10523, which D-Link says will gain CVE identifiers, technical classifications and confirmed impact as coordinated disclosure progresses.
• The first firmware release that D-Link explicitly names as a fix for these issues.
• Public CVE records and NVD entries once the reserved IDs are published.

Sources

• D-Link Security Announcement SAP10523 (primary source)
• BleepingComputer: D-Link warns of multiple zero-days in DGS-3130 Series switches