D-Link Issues Security Recommendations for Zero-Day Vulnerabilities in DGS-3130 Series Managed Switches

Key summary

D-Link has released security recommendations regarding multiple zero-day vulnerabilities found in the DGS-3130 series of managed switches, for which no patches are currently available. These vulnerabilities, discovered by engineers at Spectrum Community Solutions, affect authentication systems, access control, and the D-Link Discovery Protocol (DDP). Attackers could potentially gain access to sensitive device information, modify credentials or configurations, cause SNMP community strings to be leaked, or disrupt services and reset the device. This vulnerability affects multiple firmware versions of the DGS-3130-30TS. Before a new firmware is available, D-Link recommends disabling DDP, removing unnecessary SNMP community strings, restricting access to the SSH web UI and SNMP from the management network, storing backup configurations offline, and monitoring logs for unusual changes. D-Link is investigating the impact on other switch models and the security mechanisms of the firmware, including SSH settings, credential protection, and firmware encryption.