Reported by Bleeping Computer. D-Link has issued mitigation measures for multiple unpatched security flaws affecting its DGS-3130 series managed Gigabit stackable switches.
The vulnerabilities, discovered by network engineer Giresh Kumar Enugu, impact the D-Link Discovery Protocol authentication, access control and information handling. Although D-Link has not yet assigned Common Vulnerabilities and Exposures identifiers, the company confirmed that successful exploitation could allow attackers to access sensitive device data, perform unauthorized configuration changes, leak Simple Network Management Protocol communities or trigger service disruptions. The flaws affect several firmware versions of the DGS-3130-30TS model, with investigations ongoing regarding other switching platforms. Until patches are released, D-Link advises administrators to disable the D-Link Discovery Protocol, remove default SNMP strings and restrict access to management interfaces like SSH and the web UI to isolated networks. Administrators should also maintain offline backups and monitor logs for suspicious activity, such as unprompted reboots or factory resets. This follows a separate warning issued in September regarding a maximum-severity zero-day in legacy DIR-822A routers. These switches are primarily utilized by small-to-medium businesses and metro Ethernet deployments to manage network traffic and eliminate bottlenecks.
Source: Bleeping Computer
