D-Link said on 6 November 2026 that a researcher found flaws in its DGS-3130-30TS managed switch. Giresh Kumar Enugu of Spectrum Community Solutions reported them on 2 November and showed attacks in controlled tests. Some flaws involve weak authentication, access control and information handling in the D-Link Discovery Protocol (DDP). Others involve firmware security. D-Link says an attacker with access to the affected network may be able to read device data, change settings, or disrupt service.
D-Link has not published technical details. CVE numbers (public flaw IDs) are not out yet, and there is no fixed firmware or release date. Tests used hardware revision B1. Other models are under review, which does not mean they are vulnerable. Turning DDP off with the command no ddp blocked the DDP attacks the researcher tested, and D-Link is still checking that. It does not fix the firmware flaws. D-Link also says to remove default SNMP community strings.
Background, not a finding about these flaws: a discovery protocol lets devices on a network find and manage one another, so weak authentication on it matters. For now the fix is a feature switch-off, not a patch. Buyers should ask how many of these switches sit on networks that others can reach. D-Link says VLAN separation and access settings should not be the only defence.