D-Link published interim security announcement SAP10523 on 6 November 2026 at 12:16 GMT (last updated 12:30 GMT; 20:16–20:30 AWST the same day), saying that on 2 November 2026 it received a coordinated vulnerability disclosure concerning multiple security vulnerabilities identified during an independent security assessment of the D-Link DGS-3130-30TS managed switch.

D-Link says the reported vulnerabilities involve the D-Link Discovery Protocol (DDP) and certain components of the device's firmware security architecture.

According to the security researcher (as restated by D-Link), successful exploitation of certain vulnerabilities may allow an attacker with access to the affected network to obtain sensitive device information, perform unauthorized administrative operations, modify device configuration, or disrupt network services; D-Link says the researcher has demonstrated exploitation through controlled testing. D-Link lists potential DDP impacts including unauthorized access to DDP administrative functions, disclosure of sensitive device and network configuration information, unauthorized changes to administrative credentials, device resets/service disruption/loss of configuration, and exposure of SNMP community information.

Additional findings D-Link is evaluating cover SSH service security configuration, protection of operating-system credentials, and firmware encryption/protection of embedded cryptographic material; D-Link says disabling DDP does not by itself correct those firmware weaknesses.

D-Link says multiple findings have been submitted for CVE assignment or have received reserved identifiers, but the associated CVE records have not yet been publicly disclosed.

Affected product in confirmed testing: DGS-3130-30TS hardware revision B1; firmware versions examined 2.00.B014, 2.00.B034, 2.04.000, 2.04.001; other DGS-3130 models and other D-Link switching platforms are under investigation with impact not yet confirmed.

D-Link says it is publishing the interim advisory before corrective firmware is available and that no confirmed firmware release date is available. Immediate mitigations D-Link asks customers operating the DGS-3130-30TS to apply include disabling DDP (CLI: no ddp), removing unnecessary or default SNMP community strings, and restricting SSH, web UI and SNMP to isolated management networks and designated admin hosts. (source: D-Link SAP10523)

BleepingComputer reported the same advisory and named Spectrum Community Solutions network engineer Giresh Kumar Enugu as the finder. (source: BleepingComputer)