D-Link warns of multiple zero-days in DGS-3130 switches

D-Link has shared mitigation steps for multiple unpatched security flaws affecting its DGS-3130 Series managed Gigabit stackable switches. The company has not detailed the flaws or publicly disclosed their CVE IDs.

D-Link said Spectrum Community Solutions network engineer Giresh Kumar Enugu found vulnerabilities in the D-Link Discovery Protocol (DDP), access control and information handling. According to the company, an attacker with access to the affected network could obtain sensitive device information, make unauthorized administrative changes, alter device configuration or disrupt network services. The source also reports that exploitation could expose SNMP communities or cause device resets.

The zero-days affect multiple firmware versions of the DGS-3130-30TS. D-Link is investigating whether other switching platforms and firmware security mechanisms are affected.

Until it releases updated firmware, D-Link recommends disabling DDP, removing unnecessary or default SNMP community strings, and limiting SSH, web UI and SNMP access to isolated management networks and designated administrator hosts. It also advised administrators to keep offline configuration backups and monitor logs for unexpected configuration changes, unprompted reboots or factory resets.