# D-Link DGS-3130 Series Switches: Multiple Unpatched Zero-Days in D-Link Discovery Protocol (DDP) and Firmware (D-Link SAP10523, CVEs Pending)

> D-Link disclosed multiple unpatched vulnerabilities in DGS-3130 Series managed switches (confirmed on DGS-3130-30TS rev B1) affecting D-Link Discovery Protocol (DDP) authentication and access control, SSH configuration, OS credential protection and firmware encryption. An attacker with access to the affected network could obtain sensitive device information, perform unauthorized administrative operations, modify configuration or disrupt network services; no patch or release date exists and CVE identifiers are still pending.

- **Published:** 2026-11-06T12:45:17Z
- **Last reviewed:** 2026-11-06T12:45:17Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5414
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5414.png
- **ID:** TL-2026-5414
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** TRACKING
- **Detections:** 9 (1 shown free below) · **IOCs:** 9

## Description

On 2026-11-06 D-Link published security advisory SAP10523 (status: partial resolution) after receiving a coordinated disclosure on 2026-11-02 from researcher Giresh Kumar Enugu, a network engineer at Spectrum Community Solutions. The advisory states that successful exploitation of certain vulnerabilities may allow an attacker with access to the affected network to obtain sensitive device information. No CVE identifiers have been published; the advisory says multiple findings have been submitted for CVE assignment with reserved identifiers and public disclosure is pending. No CVSS scores have been published.

The advisory groups the issues into two categories. First, weaknesses in the D-Link Discovery Protocol (DDP): authentication and access-control weaknesses, unauthorized access to DDP administrative functions, disclosure of configuration information, credential compromise, and the potential for device reset and service disruption. Second, firmware security gaps: SSH service configuration defects, failures in operating-system credential protection, and firmware encryption weaknesses. BleepingComputer's coverage additionally describes SNMP community string leakage and embedded cryptographic keys in firmware. Possible impacts listed are unauthorized access to sensitive device data, credential and configuration modification, SNMP community string leakage, and service disruption including device resets.

Affected: DGS-3130-30TS (Hardware Revision B1), with firmware 2.00.B014, 2.00.B034, 2.04.000 and 2.04.001 examined. Other DGS-3130 variants and other D-Link switching platforms are under investigation. The DGS-3130 is a managed stackable Layer 3 Lite switch aimed at SMB and metro Ethernet deployments. No corrective firmware has been released and no release date has been given.

The sources do not report active exploitation, a public proof of concept, or any network or file IOCs. Exploitability is therefore recorded as THEORETICAL, and the HIGH severity is an analyst assignment based on the stated impact on network infrastructure and the absence of a patch; it is not a vendor rating. CWE mappings are analyst-assigned from the vendor's descriptions of the weakness categories and are not stated in the advisory. The IOC list holds defender-relevant artifacts from the advisory (affected builds, interim-mitigation commands, default SNMP communities, DDP service) and not attacker infrastructure; no BeaconBeagle lookup was applicable because no network IOCs exist. D-Link's FAQ for other switch families (DGS-1100/1210/1510, DXS-1100/1210/3400) identifies UDP/62976 as the DDP port used by D-Link Network Assistant; that port has not been confirmed for the DGS-3130.

Interim vendor mitigations: disable DDP with `no ddp` in global and interface configuration modes, remove the default `public` and `private` SNMP community strings, restrict SSH, web UI and SNMP to isolated management networks, keep offline configuration backups, and monitor logs for unexpected configuration changes, reboots or factory resets.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078.001 Default Accounts
- T1046 Network Service Discovery
- T1552 Unsecured Credentials
- T1602.001 SNMP (MIB Dump)
- T1602.002 Network Device Configuration Dump
- T1565 Data Manipulation
- T1529 System Shutdown/Reboot

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**SNMP Access Using Default 'public'/'private' Community Strings - D-Link SAP10523** (`TL-2026-5414-SPL-003`)

Detects SNMP requests that use the default community strings 'public' or 'private'. D-Link advises removing both on DGS-3130 switches, and SNMP community string leakage and configuration disclosure are listed impacts of SAP10523. Use of the default 'private' string implies write access and warrants priority review. Also surfaces sources that sweep several devices, consistent with MIB dumping.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1602.001, T1078.001, T1552
- **Data sources:** zeek, bro:snmp:json
- **Severity:** medium
- **Confidence:** high

### Splunk SPL

```spl
index=network sourcetype="bro:snmp:json" earliest=-24h
| rename "id.orig_h" AS src_ip, "id.resp_h" AS dest_ip
| eval community_lc=lower(community)
| where community_lc IN ("public", "private")
| eval write_community=if(community_lc="private", 1, 0)
| stats count AS requests dc(dest_ip) AS devices values(dest_ip) AS dest_ips values(community_lc) AS communities max(write_community) AS used_private BY src_ip
| eval severity_hint=if(used_private=1 OR devices>=3, "high", "medium")
| table src_ip communities devices dest_ips requests severity_hint
```

### Microsoft KQL

```kql
CommonSecurityLog
| where TimeGenerated > ago(24h)
| where Protocol =~ "UDP" and DestinationPort == 161
| where Message has_any ("community=public", "community=private", "community:public", "community:private") or AdditionalExtensions has_any ("public", "private")
| summarize Requests = count(), Devices = dcount(DestinationIP), Targets = make_set(DestinationIP, 50), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP
| project SourceIP, Devices, Targets, Requests, FirstSeen, LastSeen
| order by Devices desc
```

### Sigma

```yaml
title: SNMP Request Using Default Community String - TL-2026-5414
id: c3f08a52-7e19-4d6b-b2a4-5d90e61f3a77
status: experimental
description: Detects SNMP traffic using the default community strings public or private as seen in Zeek snmp.log. D-Link advisory SAP10523 recommends removing both from DGS-3130 switches; SNMP community string leakage and configuration disclosure are listed impacts.
references:
    - https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10523
    - https://attack.mitre.org/techniques/T1602/001/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-06
tags:
    - attack.collection
    - attack.t1602.001
    - attack.initial-access
    - attack.t1078.001
    - attack.credential-access
    - attack.t1552
logsource:
    product: zeek
    service: snmp
detection:
    selection:
        community:
            - 'public'
            - 'private'
    condition: selection
falsepositives:
    - Legacy monitoring systems still polling with default community strings
    - Network inventory scanners
level: medium
```

**Known false positives:**

- Legacy monitoring platforms still polling with default community strings
- Authorized SNMP discovery scans

**Tuning notes:** Allowlist known NMS source IPs and remediate their community strings. Requires Zeek snmp.log ingestion (SNMPv1/v2c only; v3 hides community). Escalate any use of 'private' or one source touching several switches. Remove default communities per D-Link guidance to eliminate the alert.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Endpoint DDP Activity: D-Link Network Assistant or UDP/62976 From Host - SAP10523 (locked: unlock with TL Creds)
- D-Link Switch Login With Default Account or From Non-Management Source - SAP10523 (locked: unlock with TL Creds)
- SNMP Polling of Switches From Non-Management Sources (MIB Dump / Community Leakage) - SAP10523 (locked: unlock with TL Creds)
- D-Link DDP UDP/62976 Access to Switch Management Plane - Sigma Primary (locked: unlock with TL Creds)
- D-Link Switch Reset, Reboot or Config Tampering Logged - Sigma Primary (locked: unlock with TL Creds)
- SNMP Default Community String 'public'/'private' Observed - Sigma Primary (locked: unlock with TL Creds)
- D-Link DGS-3130 DDP (UDP/62976) Traffic From Non-Management Source - SAP10523 (locked: unlock with TL Creds)
- D-Link Switch Unexpected Reset, Reboot or Configuration Change - SAP10523 (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [D-Link warns of multiple zero-days in DGS-3130 Series switches (BleepingComputer)](https://www.bleepingcomputer.com/news/security/d-link-warns-of-multiple-zero-days-in-dgs-3130-series-switches/)
- [D-Link Security Advisory SAP10523](https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10523)
- [D-Link Security Announcements portal](https://supportannouncement.us.dlink.com/)
- [D-Link FAQ: Switch port 62976 (D-Link Discovery Protocol, other switch families)](https://www.dlink.com/de/de/support/faq/smart-switches/de_switch_port_62976)
- [MITRE ATT&CK T1602 Data from Configuration Repository](https://attack.mitre.org/techniques/T1602/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5414