# D-Link DGS-3130-30TS interim advisory: multiple unpatched DDP and firmware zero-days (SAP10523) · pwn.watch > On Nov 6 2026 D-Link published interim security announcement SAP10523 for multiple vulnerabilities in the DGS-3130-30TS managed switch (hardware revision B1), reported by Giresh Kumar Enugu of Spectrum Community Solutions on Nov 2. The findings cover D-Link Discovery Protocol (DDP) authentication, access control and information handling, plus separate firmware-security issues around SSH configuration, OS credential protection, and firmware encryption/embedded keys. Successful exploitation on an affected network may allow sensitive device data disclosure, unauthorized admin/config changes, SNMP community exposure, service disruption or device resets. Examined firmware includes 2.00.B014, 2.00.B034, 2.04.000 and 2.04.001; other DGS-3130 models and D-Link switching platforms are under investigation. No corrective firmware is available yet; D-Link recommends disabling DDP (`no ddp`), removing default SNMP communities, and restricting management access. CVE identifiers are reserved or submitted but not yet public. Page: https://pwn.watch/i/d-link-dgs-3130-ddp-firmware-zero-days-nov-2026 · generated 2026-11-06T17:04:01.956Z ## Status - Severity: high · status: live · patch: unpatched - Product: D-Link DGS-3130-30TS (H/W Rev. B1); other DGS-3130 / switching platforms under investigation - Started: 2026-11-06 - Affected: DGS-3130-30TS H/W Rev. B1 firmware 2.00.B014, 2.00.B034, 2.04.000, 2.04.001 (examined; individual findings may apply to subsets); Other DGS-3130 models and D-Link switching platforms: impact not yet confirmed - Fixed in: No corrective firmware release identified yet; interim mitigations: disable DDP globally and on interfaces, remove default SNMP communities (public/private), restrict SSH/web/SNMP to management networks ## Follow this incident - RSS (one item per update): https://pwn.watch/i/d-link-dgs-3130-ddp-firmware-zero-days-nov-2026/feed.xml - JSON Feed: https://pwn.watch/i/d-link-dgs-3130-ddp-firmware-zero-days-nov-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/d-link-dgs-3130-ddp-firmware-zero-days-nov-2026.json - This file: https://pwn.watch/i/d-link-dgs-3130-ddp-firmware-zero-days-nov-2026/llms.txt ## Updates (newest first) - 2026-11-06: D-Link publishes interim advisory SAP10523 before corrective firmware is available, urging customers to disable DDP, remove default SNMP communities, and restrict management access. (https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10523) - 2026-11-06: BleepingComputer reports D-Link's warning of multiple zero-days in DGS-3130 series switches. (https://www.bleepingcomputer.com/news/security/d-link-warns-of-multiple-zero-days-in-dgs-3130-series-switches/) - 2026-11-02: D-Link receives coordinated disclosure of multiple DDP and firmware security findings on DGS-3130-30TS from Giresh Kumar Enugu (Spectrum Community Solutions). (https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10523) ## Fix brief # Security brief: D-Link DGS-3130-30TS interim advisory: multiple unpatched DDP and firmware zero-days (SAP10523) Source: https://pwn.watch/i/d-link-dgs-3130-ddp-firmware-zero-days-nov-2026 · status: live · severity: high · updated Nov 6, 2026, 16:19 UTC ## Patch status **UNPATCHED: no fixed release yet. Apply mitigations and watch for updates.** ## What it is On Nov 6 2026 D-Link published interim security announcement SAP10523 for multiple vulnerabilities in the DGS-3130-30TS managed switch (hardware revision B1), reported by Giresh Kumar Enugu of Spectrum Community Solutions on Nov 2. The findings cover D-Link Discovery Protocol (DDP) authentication, access control and information handling, plus separate firmware-security issues around SSH configuration, OS credential protection, and firmware encryption/embedded keys. Successful exploitation on an affected network may allow sensitive device data disclosure, unauthorized admin/config changes, SNMP community exposure, service disruption or device resets. Examined firmware includes 2.00.B014, 2.00.B034, 2.04.000 and 2.04.001; other DGS-3130 models and D-Link switching platforms are under investigation. No corrective firmware is available yet; D-Link recommends disabling DDP (`no ddp`), removing default SNMP communities, and restricting management access. CVE identifiers are reserved or submitted but not yet public. Severity detail: Network-adjacent management impact via DDP and related firmware weaknesses on enterprise SMB/metro switches; no public CVE IDs or firmware fix yet; researcher demonstrated exploitation in controlled testing - Product: D-Link DGS-3130-30TS (H/W Rev. B1); other DGS-3130 / switching platforms under investigation ## Affected versions - DGS-3130-30TS H/W Rev. B1 firmware 2.00.B014, 2.00.B034, 2.04.000, 2.04.001 (examined; individual findings may apply to subsets) - Other DGS-3130 models and D-Link switching platforms: impact not yet confirmed ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix Upgrade to one of these fixed versions (or later on the same branch): - No corrective firmware release identified yet; interim mitigations: disable DDP globally and on interfaces, remove default SNMP communities (public/private), restrict SSH/web/SNMP to management networks After upgrading, re-run the checks above and redeploy/restart the affected services. ## Mitigations The data marks this as unpatched. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Latest updates - Nov 6, 2026: D-Link publishes interim advisory SAP10523 before corrective firmware is available, urging customers to disable DDP, remove default SNMP communities, and restrict management access. - Nov 6, 2026: BleepingComputer reports D-Link's warning of multiple zero-days in DGS-3130 series switches. - Nov 2, 2026: D-Link receives coordinated disclosure of multiple DDP and firmware security findings on DGS-3130-30TS from Giresh Kumar Enugu (Spectrum Community Solutions). ## Advisories - [DGS-3130-30TS H/W Rev. B1 — Multiple DDP Protocol and Firmware Security Vulnerabilities (SAP10523)](https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10523) (D-Link) ## Write-ups & news - [D-Link warns of multiple zero-days in DGS-3130 Series switches](https://www.bleepingcomputer.com/news/security/d-link-warns-of-multiple-zero-days-in-dgs-3130-series-switches/) ## Caveats CVE IDs reserved/submitted but not publicly disclosed as of the Nov 6 interim advisory. Disabling DDP does not address the separate firmware-security findings. Distinct from older tracked D-Link router/NAS CVEs. --- Machine-readable: https://pwn.watch/i/d-link-dgs-3130-ddp-firmware-zero-days-nov-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.