D-Link has warned that multiple unpatched security flaws in its DGS-3130-30TS managed switch could let attackers with access to the affected network obtain sensitive device information, change administrator credentials or device settings, expose SNMP community information, and disrupt network services or reset the switch. The company published an interim security advisory on November 6 after receiving a coordinated vulnerability disclosure on November 2.
The reported weaknesses affect the D-Link Discovery Protocol (DDP), including its authentication, access-control and information-handling functions. D-Link said a security researcher demonstrated several of the reported conditions through controlled testing on a DGS-3130-30TS unit with hardware revision B1.
The advisory lists four firmware versions examined during the assessment: 2.00.B014, 2.00.B034, 2.04.000 and 2.04.001. D-Link cautioned that individual findings may apply to different subsets of those versions. The company is still assessing other DGS-3130 models and switching platforms, and has not confirmed that they are affected.
D-Link has not publicly disclosed CVE identifiers for the issues. The company said multiple findings have been submitted for CVE assignment or have received reserved identifiers, but the associated records are not yet public.
The disclosure also includes separate concerns involving firmware security mechanisms, including SSH service configuration, protection of operating-system credentials, firmware encryption and embedded cryptographic material. D-Link is evaluating those findings separately because disabling DDP does not correct weaknesses elsewhere in the firmware.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
