D-Link has issued mitigation guidance for multiple unpatched security flaws affecting its DGS-3130 Series managed Gigabit stackable switches. The devices provide multi-gigabit uplinks and are aimed primarily at small and medium-sized businesses and metro Ethernet deployments. D-Link has not yet published CVE identifiers for the issues and has not released details of the flaws.
According to D-Link, the vulnerabilities were reported by Giresh Kumar Enugu, a network engineer at Spectrum Community Solutions. They involve the D-Link Discovery Protocol (DDP), including its authentication, access control, and information handling. The company says the flaws affect several DGS-3130-30TS firmware versions and that it is still assessing whether other D-Link switching platforms are affected, as well as parts of the firmware security architecture such as SSH configuration, operating system credential protection, and handling of firmware encryption and embedded cryptographic keys.
If exploited, the flaws could allow an attacker with access to the affected network to:
- Obtain sensitive device information
- Make unauthorized administrative changes or modify configuration
- Leak SNMP community strings
- Cause service disruptions or device resets
Until a firmware update is released, D-Link recommends the following measures:
- Disable DDP, which the company describes as the primary known attack vector
- Remove unnecessary or default SNMP community strings
- Restrict SSH, web management interface, and SNMP access to isolated management networks and designated administrator hosts
- Maintain offline backups of switch configurations
- Monitor device logs for unexpected configuration changes, unprompted reboots, or factory resets
Administrators running DGS-3130 switches should apply these controls promptly, inventory where DDP and SNMP are enabled, and watch for vendor advisories that will accompany the eventual firmware fix.
