D-Link discloses unpatched zero-days in DGS-3130 switches

On Nov. 6, 2026, D-Link disclosed several unpatched zero-day flaws in its DGS-3130 series of managed Gigabit stackable switches. No firmware patch was available at the time of the advisory. The vulnerabilities were discovered by Giresh Kumar Enugu, a network engineer at Spectrum Community Solutions. These switches offer multi-gigabit uplinks and are built mainly for small-to-medium business and metro Ethernet deployments.

The reported weaknesses involve DDP authentication and information handling, along with access control enforcement. On Nov. 6, 2026, D-Link said the flaws involve DDP and portions of the device’s firmware security architecture, describing the advisory’s reach as extending past the discovery protocol. “The reported vulnerabilities involve the D-Link Discovery Protocol (DDP) and certain components of the device’s firmware security architecture,” D-Link said.

Attackers who succeed could obtain sensitive device information and carry out unauthorized administrative operations. They could also change device configuration, interrupt network services, expose SNMP community strings, or cause reboots and factory resets. The company has not disclosed CVE identifiers or published detailed technical information about the flaws. No confirmed evidence exists of active exploitation, customer harm, or stolen data.

Several DGS-3130-30TS firmware versions are affected, though which versions are affected is still being determined. Testing confirmed so far covered DGS-3130-30TS hardware revision B1 only. D-Link is investigating whether other switching platforms are affected and has not confirmed any additional exploitable vulnerabilities. D-Link has also not confirmed whether other models from D-Link are affected.

In September 2026, D-Link issued a warning about CVE-2026-86296, a maximum-severity zero-day in legacy DIR-822A dual-band Wi-Fi routers. That earlier flaw had no patch, and a public proof-of-concept exploit existed.

D-Link recommends turning off DDP, calling it the primary known attack vector. Switching DDP off may disrupt workflows that rely on device discovery features.

Administrators should remove default and unnecessary SNMP community strings. Management access through SSH, the web UI, or SNMP should go only to trusted admin hosts on isolated networks. According to D-Link, SNMP access belongs on trusted management networks only.

Switch configuration backups should be kept offline. Checking device logs may show unexpected changes, spontaneous reboots, or factory resets. Administrators should investigate unplanned reboots and factory resets on the devices.

Since no official patch exists yet, the flaws qualify as zero-days. D-Link is examining embedded cryptographic keys, firmware encryption, operating-system credential protection, and SSH service configuration.