D-Link DGS-3130 zero-days: no fix yet, so lock it down

D-Link has confirmed several unpatched zero-days in its DGS-3130 managed switches, and there is no firmware fix yet. The DGS-3130 is a stackable gigabit switch that D-Link sells to small and mid-sized businesses. The bugs could let someone on your network read device data, change the switch's configuration or credentials, or knock it offline. Until a patch ships, the fix is configuration.

What actually happened

BleepingComputer reported on November 6 that D-Link published mitigation steps for the flaws:

• Who found them. Giresh Kumar Enugu, a network engineer at Spectrum Community Solutions.
• Where they are. Authentication, access control and information handling in the D-Link Discovery Protocol (DDP), plus parts of the firmware's security design.
• What an attacker gets. Sensitive device data, unauthorized credential or configuration changes, leaked SNMP community strings, or service disruption and device resets.
• Who can attack. D-Link says the attacker needs "access to the affected network." That means anyone on the same LAN: a guest, a compromised laptop, a bad IoT device.
• What's affected. Several DGS-3130-30TS firmware versions. D-Link is still checking other switch models, plus SSH settings, stored OS credentials and firmware encryption keys.
• What's missing. CVE IDs and a firmware fix.

D-Link's advisory page didn't load when we checked, so we're relying on BleepingComputer's report of it. Several summaries list exact firmware builds, but we couldn't confirm them against D-Link directly, so we left them out. If you run any DGS-3130, assume you're affected.

Why the D-Link zero-days matter for your business

Switches get installed once and forgotten. A "LAN-only" bug matters more than it sounds, because most small-business networks are flat: the guest Wi-Fi, the POS terminals and the office PCs all reach the switch's admin page. D-Link's own advice is the right list:

1. Turn off DDP. It's the main known attack path, and most small networks don't need it.
2. Remove default and unused SNMP community strings. If you don't monitor the switch over SNMP, turn SNMP off.
3. Put SSH, the web UI and SNMP on a management VLAN that only one or two admin machines can reach.
4. Back up the config offline, then watch the logs for config changes, reboots or factory resets you didn't make.

We gave the same advice for Zyxel's GS1900 zero-day yesterday. Different vendor, same lesson: limit who can reach the admin interface and you're safer before the patch exists.

Sources: BleepingComputer.