D-Link DGS-3130 Series Switches: Multiple Unpatched Zero-Days in D-Link Discovery Protocol (DDP) and Firmware (D-Link SAP10523, CVEs Pending)

Key facts for D-Link DGS-3130 unpatched DDP

Detection coverage for D-Link DGS-3130 unpatched DDP

As of 2026-11-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5414 across Splunk SPL, Microsoft KQL and Sigma, covering 9 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SNMP Access Using Default 'public'/'private' Community Strings - D-Link SAP10523

Detects SNMP requests that use the default community strings 'public' or 'private'. D-Link advises removing both on DGS-3130 switches, and SNMP community string leakage and configuration disclosure are listed impacts of SAP10523. Use of the default 'private' string implies write access and warrants priority review. Also surfaces sources that sweep several devices, consistent with MIB dumping.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1602.001, T1078.001, T1552
• Data sources: zeek, bro:snmp:json
• Severity: medium
• Confidence: high

Splunk SPL

index=network sourcetype="bro:snmp:json" earliest=-24h
| rename "id.orig_h" AS src_ip, "id.resp_h" AS dest_ip
| eval community_lc=lower(community)
| where community_lc IN ("public", "private")
| eval write_community=if(community_lc="private", 1, 0)
| stats count AS requests dc(dest_ip) AS devices values(dest_ip) AS dest_ips values(community_lc) AS communities max(write_community) AS used_private BY src_ip
| eval severity_hint=if(used_private=1 OR devices>=3, "high", "medium")
| table src_ip communities devices dest_ips requests severity_hint

Microsoft KQL

CommonSecurityLog
| where TimeGenerated > ago(24h)
| where Protocol =~ "UDP" and DestinationPort == 161
| where Message has_any ("community=public", "community=private", "community:public", "community:private") or AdditionalExtensions has_any ("public", "private")
| summarize Requests = count(), Devices = dcount(DestinationIP), Targets = make_set(DestinationIP, 50), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP
| project SourceIP, Devices, Targets, Requests, FirstSeen, LastSeen
| order by Devices desc

Sigma

title: SNMP Request Using Default Community String - TL-2026-5414
id: c3f08a52-7e19-4d6b-b2a4-5d90e61f3a77
status: experimental
description: Detects SNMP traffic using the default community strings public or private as seen in Zeek snmp.log. D-Link advisory SAP10523 recommends removing both from DGS-3130 switches; SNMP community string leakage and configuration disclosure are listed impacts.
references:
    - https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10523
    - https://attack.mitre.org/techniques/T1602/001/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
    - attack.collection
    - attack.t1602.001
    - attack.initial-access
    - attack.t1078.001
    - attack.credential-access
    - attack.t1552
logsource:
    product: zeek
    service: snmp
detection:
    selection:
        community:
            - 'public'
            - 'private'
    condition: selection
falsepositives:
    - Legacy monitoring systems still polling with default community strings
    - Network inventory scanners
level: medium

Known false positives:

• Legacy monitoring platforms still polling with default community strings
• Authorized SNMP discovery scans

Tuning notes: Allowlist known NMS source IPs and remediate their community strings. Requires Zeek snmp.log ingestion (SNMPv1/v2c only; v3 hides community). Escalate any use of 'private' or one source touching several switches. Remove default communities per D-Link guidance to eliminate the alert.

• 🔒 Endpoint DDP Activity: D-Link Network Assistant or UDP/62976 From Host - SAP10523 · unlock with TL Creds
• 🔒 D-Link Switch Login With Default Account or From Non-Management Source - SAP10523 · unlock with TL Creds
• 🔒 SNMP Polling of Switches From Non-Management Sources (MIB Dump / Community Leakage) - SAP10523 · unlock with TL Creds
• 🔒 D-Link DDP UDP/62976 Access to Switch Management Plane - Sigma Primary · unlock with TL Creds
• 🔒 D-Link Switch Reset, Reboot or Config Tampering Logged - Sigma Primary · unlock with TL Creds
• 🔒 SNMP Default Community String 'public'/'private' Observed - Sigma Primary · unlock with TL Creds
• 🔒 D-Link DGS-3130 DDP (UDP/62976) Traffic From Non-Management Source - SAP10523 · unlock with TL Creds
• 🔒 D-Link Switch Unexpected Reset, Reboot or Configuration Change - SAP10523 · unlock with TL Creds

Indicators of compromise for D-Link DGS-3130 unpatched DDP

As of 2026-11-06, Threadlinqs Intelligence tracks 9 indicators of compromise for TL-2026-5414.

How D-Link DGS-3130 unpatched DDP works

On 2026-11-06 D-Link published security advisory SAP10523 (status: partial resolution) after receiving a coordinated disclosure on 2026-11-02 from researcher Giresh Kumar Enugu, a network engineer at Spectrum Community Solutions. The advisory states that successful exploitation of certain vulnerabilities may allow an attacker with access to the affected network to obtain sensitive device information. No CVE identifiers have been published; the advisory says multiple findings have been submitted for CVE assignment with reserved identifiers and public disclosure is pending. No CVSS scores have been published.

The advisory groups the issues into two categories. First, weaknesses in the D-Link Discovery Protocol (DDP): authentication and access-control weaknesses, unauthorized access to DDP administrative functions, disclosure of configuration information, credential compromise, and the potential for device reset and service disruption. Second, firmware security gaps: SSH service configuration defects, failures in operating-system credential protection, and firmware encryption weaknesses. BleepingComputer's coverage additionally describes SNMP community string leakage and embedded cryptographic keys in firmware. Possible impacts listed are unauthorized access to sensitive device data, credential and configuration modification, SNMP community string leakage, and service disruption including device resets.

Affected: DGS-3130-30TS (Hardware Revision B1), with firmware 2.00.B014, 2.00.B034, 2.04.000 and 2.04.001 examined. Other DGS-3130 variants and other D-Link switching platforms are under investigation. The DGS-3130 is a managed stackable Layer 3 Lite switch aimed at SMB and metro Ethernet deployments. No corrective firmware has been released and no release date has been given.

The sources do not report active exploitation, a public proof of concept, or any network or file IOCs. Exploitability is therefore recorded as THEORETICAL, and the HIGH severity is an analyst assignment based on the stated impact on network infrastructure and the absence of a patch; it is not a vendor rating. CWE mappings are analyst-assigned from the vendor's descriptions of the weakness categories and are not stated in the advisory. The IOC list holds defender-relevant artifacts from the advisory (affected builds, interim-mitigation commands, default SNMP communities, DDP service) and not attacker infrastructure; no BeaconBeagle lookup was applicable because no network IOCs exist. D-Link's FAQ for other switch families (DGS-1100/1210/1510, DXS-1100/1210/3400) identifies UDP/62976 as the DDP port used by D-Link Network Assistant; that port has not been confirmed for the DGS-3130.

Interim vendor mitigations: disable DDP with `no ddp` in global and interface configuration modes, remove the default `public` and `private` SNMP community strings, restrict SSH, web UI and SNMP to isolated management networks, keep offline configuration backups, and monitor logs for unexpected configuration changes, reboots or factory resets.

MITRE ATT&CK techniques by tactic:

Discovery

T1046 Network Service Discovery

Initial Access

T1078.001 Default Accounts; T1190 Exploit Public-Facing Application

Impact

T1529 System Shutdown/Reboot; T1565 Data Manipulation

Credential Access

T1552 Unsecured Credentials

Collection

T1602.001 SNMP (MIB Dump); T1602.002 Network Device Configuration Dump

Remediation for D-Link DGS-3130 unpatched DDP

Patches

• No firmware fix available; D-Link has given no release date (SAP10523, status: partial resolution)

Immediate actions

• Disable DDP with 'no ddp' in global and interface configuration modes
• Remove the default 'public' and 'private' SNMP community strings
• Restrict SSH, web UI and SNMP access to isolated management networks and authorized hosts only

Workarounds

• Maintain offline backups of switch configurations
• Monitor logs for unexpected configuration changes, reboots or factory resets

Longer-term hardening

• Place switch management planes on a dedicated out-of-band or isolated management VLAN
• Inventory DGS-3130 and other D-Link switching platforms, since other models are under investigation
• Monitor D-Link security announcements for firmware and CVE assignments

Affected and fixed versions

• D-Link — DGS-3130-30TS (Hardware Revision B1)
  Vulnerable versions: 2.00.B014; 2.00.B034; 2.04.000; 2.04.001
• D-Link — Other DGS-3130 variants and other D-Link switching platforms (under investigation)

Timeline of D-Link DGS-3130 unpatched DDP

• 2026-11-02 locked-ioc-9 receives coordinated vulnerability disclosure from researcher locked-ioc-8 (locked-ioc-6) covering DDP and firmware weaknesses in DGS-3130 switches.
• 2026-11-06 No corrective firmware release date confirmed; locked-ioc-9 continues to investigate other DGS-3130 variants and other switching platforms.
• 2026-11-06 BleepingComputer reports the unpatched zero-days in DGS-3130 Series switches, including SNMP community string leakage and firmware encryption and embedded-key weaknesses.
• 2026-11-06 Advisory states multiple findings were submitted for CVE assignment with reserved identifiers; no CVE IDs or CVSS scores are public.
• 2026-11-06 locked-ioc-9 updates SAP10523 at 12:30 GMT; interim mitigations (disable DDP, remove default SNMP communities, restrict management access) are listed.
• 2026-11-06 locked-ioc-9 publishes security advisory SAP10523 at 12:16 GMT with status 'partial resolution', listing DGS-3130-30TS rev B1 firmware 2.00.B014, 2.00.B034, 2.04.000 and 2.04.001 as examined.

Sources cited for D-Link DGS-3130 unpatched DDP

• D-Link Security Announcements portal supportannouncement.us.dlink.com · Advisory
• D-Link Security Advisory SAP10523 supportannouncement.us.dlink.com · Vendor report · 2026-11-06
• D-Link FAQ: Switch port 62976 (D-Link Discovery Protocol, other switch families) dlink.com · Vendor report
• MITRE ATT&CK T1602 Data from Configuration Repository MITRE · Research
• D-Link warns of multiple zero-days in DGS-3130 Series switches (BleepingComputer) BleepingComputer · News · 2026-11-06

More in vulnerability

• Metasploit 6.5.9 Wrapup: Public Exploit Modules for Citrix NetScaler (CVE-2026-88771), Cisco Secure Email Gateway (CVE-2026-76461/76443), GitLab CI/CD Regex RCE (CVE-2026-97229), OpenBullet2, Flowise, SPIP and WordPress Bug Library
• CVE-2026-113618: Improper Certificate Validation in KAMSOFT ZSIRep CLIENT library
• Multiple Vulnerabilities in Microsoft Edge (prior to 157.0.4341.42) - 27 Chromium CVEs - HK GovCERT A26-11-10
• Apple September 2026 Security Updates: 273 CVEs incl. actively exploited Screen Sharing auth bypass (CVE-2026-65400) and critical Bluetooth RCE (CVE-2026-65414)
• OpenAI GPT-6 Cyber Identifies 81 Previously Unknown High-Severity Firefox Vulnerabilities (Mozilla MFSA2026-118, Firefox 159)