{"id":"TECH-202611-eqjfj5","kind":"technique","aliases":[],"related":[],"title":"Unpatched D-Link DGS-3130 switch flaws in the D-Link Discovery Protocol (DDP) let someone on the network read device data, change credentials and config, and reset the switch (no fix, no CVE yet)","description":null,"summary":"On 6 Nov 2026 D-Link warned of several unpatched flaws in DGS-3130 series managed stackable switches, found by researcher Giresh Kumar Enugu. The bugs are in D-Link Discovery Protocol (DDP) authentication, access control and information handling. An attacker with access to the switch's network can get sensitive device information, make unauthorized admin, credential and configuration changes, leak SNMP community strings, or disrupt service and reset the device. Confirmed affected: multiple DGS-3130-30TS firmware versions. D-Link is still checking other switching platforms and firmware security parts (SSH configuration, OS credential safeguards, firmware encryption and embedded keys). D-Link has not published details or CVE IDs. Exploitation in the wild: unknown, none reported.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"D-Link DGS-3130","fixed":[],"affected":"DGS-3130-30TS, multiple firmware versions (unspecified)","ecosystem":"vendor"}],"ecosystems":[],"tags":["early-warning","technique"],"not_affected_if":[],"how_to_check":"Find D-Link DGS-3130 series switches, especially DGS-3130-30TS, in your inventory. Check whether DDP (D-Link Discovery Protocol) is enabled, whether default or unused SNMP community strings are set, and whether SSH, web UI or SNMP can be reached from user or untrusted networks. In switch logs, look for unexpected configuration changes, unprompted reboots or factory resets. Specific affected firmware versions: unknown (D-Link says multiple DGS-3130-30TS versions).","fix":"No firmware fix yet. Follow D-Link's mitigations now: disable DDP, remove unnecessary or default SNMP community strings, allow SSH, web UI and SNMP only from an isolated management network and named admin hosts, keep offline backups of switch configurations, and watch logs for unexpected config changes, reboots or factory resets. Install new firmware when D-Link releases it.","status":"open","published_at":null,"first_seen_at":"2026-11-06T12:42:42+00:00","triaged_at":"2026-11-06T12:42:42+00:00","updated_at":"2026-11-06T12:43:00+00:00","category":"infrastructure","confidence":null,"triage":null,"analyst_status":"done","analyst_note":null,"search":"'-202611':39A '-30':128B '-3130':6A,45A,64B,127B '2026':53B '6':51B 'access':86B,94B 'admin':107B 'affect':124B 'attack':92B 'authent':85B 'bug':76B 'chang':25A,111B 'check':137B 'communiti':114B 'config':28A 'configur':110B,146B 'confirm':123B 'control':87B 'credenti':26A,108B,148B 'cve':36A,163B 'd':3A,12A,42A,55B,80B,133B,156B 'd-link':2A,11A,41A,54B,79B,132B,155B 'data':24A 'ddp':16A,84B 'detail':161B 'devic':23A,103B,122B 'dgs':5A,44A,63B,126B 'discoveri':14A,82B 'disrupt':117B 'earli':47B 'early-warn':46B 'embed':153B 'encrypt':151B 'enugu':74B 'eqjfj5':40A 'exploit':165B 'firmwar':130B,142B,150B 'fix':34A 'flaw':8A,61B 'found':69B 'get':101B 'giresh':72B 'handl':90B 'id':164B 'inform':89B,104B 'key':154B 'kumar':73B 'leak':112B 'let':17A 'link':4A,13A,43A,56B,81B,134B,157B 'make':105B 'manag':66B 'multipl':125B 'network':21A,99B 'none':170B 'nov':52B 'os':147B 'part':144B 'platform':140B 'protocol':15A,83B 'publish':160B 'read':22A 'report':171B 'research':71B 'reset':30A,120B 'safeguard':149B 'secur':143B 'sensit':102B 'seri':65B 'servic':118B 'sever':59B 'snmp':113B 'someon':18A 'ssh':145B 'stackabl':67B 'still':136B 'string':115B 'switch':7A,32A,68B,97B,139B 'tech':38A 'techniqu':49B 'ts':129B 'unauthor':106B 'unknown':169B 'unpatch':1A,60B 'version':131B 'warn':48B,57B 'wild':168B 'yet':37A","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["dgs3130","dlinkdgs3130"],"ptokens":["3130","dgs","link"],"labels":["earlywarning","high","infrastructure","technique"],"campaign_type":"exploitation","search_a":"'-202611':39A '-3130':6A,45A 'chang':25A 'config':28A 'credenti':26A 'cve':36A 'd':3A,12A,42A 'd-link':2A,11A,41A 'data':24A 'ddp':16A 'devic':23A 'dgs':5A,44A 'discoveri':14A 'eqjfj5':40A 'fix':34A 'flaw':8A 'let':17A 'link':4A,13A,43A 'network':21A 'protocol':15A 'read':22A 'reset':30A 'someon':18A 'switch':7A,32A 'tech':38A 'unpatch':1A 'yet':37A","search_b":"'-30':128B '-3130':64B,127B '2026':53B '6':51B 'access':86B,94B 'admin':107B 'affect':124B 'attack':92B 'authent':85B 'bug':76B 'chang':111B 'check':137B 'communiti':114B 'configur':110B,146B 'confirm':123B 'control':87B 'credenti':108B,148B 'cve':163B 'd':55B,80B,133B,156B 'd-link':54B,79B,132B,155B 'ddp':84B 'detail':161B 'devic':103B,122B 'dgs':63B,126B 'discoveri':82B 'disrupt':117B 'earli':47B 'early-warn':46B 'embed':153B 'encrypt':151B 'enugu':74B 'exploit':165B 'firmwar':130B,142B,150B 'flaw':61B 'found':69B 'get':101B 'giresh':72B 'handl':90B 'id':164B 'inform':89B,104B 'key':154B 'kumar':73B 'leak':112B 'link':56B,81B,134B,157B 'make':105B 'manag':66B 'multipl':125B 'network':99B 'none':170B 'nov':52B 'os':147B 'part':144B 'platform':140B 'protocol':83B 'publish':160B 'report':171B 'research':71B 'reset':120B 'safeguard':149B 'secur':143B 'sensit':102B 'seri':65B 'servic':118B 'sever':59B 'snmp':113B 'ssh':145B 'stackabl':67B 'still':136B 'string':115B 'switch':68B,97B,139B 'techniqu':49B 'ts':129B 'unauthor':106B 'unknown':169B 'unpatch':60B 'version':131B 'warn':48B,57B 'wild':168B","search_c":"","first_public_at":"2026-11-06T12:37:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"analyst","external_id":"TECH-202611-eqjfj5","url":null,"severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-11-06T12:42:42+00:00","fetched_at":"2026-11-06T12:42:42+00:00","note":null}],"documents":[{"id":86269,"url":"https://x.com/BleepinComputer/status/2118684227147350081","title":"@BleepinComputer: D-Link warns of multiple zero-days in DGS-3130 Series switches\nhttps://t.co/vZB6","kind":"post","source":"x","publisher":null,"text":"D-Link warns of multiple zero-days in DGS-3130 Series switches\nhttps://t.co/vZB6YH3vLV\n\nhttps://t.co/vZB6YH3vLV\n\nlikes 7 reposts 1","published_at":"2026-11-06T12:37:37+00:00","relation":"describes","confidence":null,"note":null},{"id":86297,"url":"https://www.bleepingcomputer.com/news/security/d-link-warns-of-multiple-zero-days-in-dgs-3130-series-switches/","title":"D-Link warns of multiple zero-days in DGS-3130 Series switches","kind":"blog","source":"blog","publisher":null,"text":"D-Link shared mitigation measures for multiple unpatched security flaws affecting DGS-3130 series managed Gigabit stackable switches. D-Link has not shared details or CVE IDs. Researcher Giresh Kumar Enugu (Spectrum Community Solutions) found bugs in D-Link Discovery Protocol (DDP) authentication, access control and information handling. Exploitation could let an attacker with access to the affected network obtain sensitive device data, make unauthorized credential/configuration changes, leak SNMP communities, or cause service disruptions and device resets. Affects multiple DGS-3130-30TS firmware versions; D-Link is still investigating other switching platforms and firmware security mechanisms (SSH service security configuration, OS credential safeguards, firmware encryption/embedded cryptographic keys). Until new firmware: disable DDP, remove unnecessary or default SNMP community strings, restrict SSH, web UI and SNMP to isolated management networks and designated admin hosts, keep offline config backups, watch logs for unexpected configuration changes, unprompted reboots or factory resets.","published_at":"2026-11-06T12:37:22+00:00","relation":"describes","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}