D-Link warns of multiple zero-days in DGS-3130 Series switches
A security flaw has been discovered in the DGS-3130 Series, with sufficient detail now available for defenders to take action.
A security flaw has come to light in DGS-3130 Series, with enough detail now public for defenders to act on it.
This requires local or already-authenticated access to reach.
DGS-3130 Series shared mitigation measures for multiple unpatched security flaws affecting DGS-3130 series managed Gigabit stackable switches.
While DGS-3130 Series didn't share details on these flaws and has yet to publicly disclose the CVE IDs for easier tracking, it said Spectrum Community Solutions network engineer Giresh Kumar Enugu found the bugs in the DGS-3130 Series Discovery Protocol (DDP) authentication, access control, and information handling.
Until it releases new firmware to address these flaws, DGS-3130 Series asked admins to disable DDP to remove the primary known attack vector, remove unnecessary or default SNMP community strings, and restrict SSH, web UI, and SNMP accessibility solely to isolated management networks and designated admin hosts.
In September, DGS-3130 Series warned customers of a maximum-severity zero-day (tracked as CVE-2026-86296 ) with a public proof-of-concept (PoC) exploit and no patch, affecting legacy DIR-822A dual-band Wi-Fi routers.
Anyone running DGS-3130 Series is exposed, specifically wherever DGS-3130 Series is actually deployed rather than just licensed or installed somewhere unused.
These switch models provide multi-gigabit uplinks, allowing enterprise network administrators to eliminate data bottlenecks, and are designed primarily for small-to-medium businesses (SMBs) and metro Ethernet deployments.
Successful exploitation could allow attackers to obtain sensitive device data, make unauthorized credential/configuration changes, leak SNMP communities, or cause service disruptions and device resets.
What an attacker actually gains: the advisory describes a real security impact once the vulnerable path is reached.
The zero-days affect multiple DGS-3130-30TS firmware versions, and the company is still investigating the impact on other DGS-3130 Series switching platforms and firmware security mechanisms (including SSH service security configuration, safeguards underlying operating-system credentials, and handles firmware encryption/embedded cryptographic keys).
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
This is tracked as CVE-2026-86296 and rated medium severity, which is the identifier to use when checking vendor guidance.
Arista patches new VeloCloud Orchestrator zero-day exploited in attacks PHP warns admins of two critical flaws, emergency patches coming tomorrow
DGS-3130 Series also advised admins to maintain offline switch configuration backups and track device logs for unexpected configuration changes, unprompted reboots, or factory resets.
Confirm whether DGS-3130 Series is present anywhere in your asset and software inventory.
No exploitation has been reported yet, but that status can change, so keep watching vendor guidance while you remediate.
What happened
A security flaw has been discovered in the DGS-3130 Series, with sufficient detail now available for defenders to take action.
Exploitation requires local or already-authenticated access.
DGS-3130 Series has shared mitigation measures for multiple unpatched security flaws affecting its managed Gigabit stackable switches.
What changed
While DGS-3130 Series did not disclose specific details about these flaws or provide CVE IDs for easier tracking, it noted that Spectrum Community Solutions network engineer Giresh Kumar Enugu identified the vulnerabilities in the DGS-3130 Series Discovery Protocol (DDP) related to authentication, access control, and information handling.
Until new firmware is released to address these flaws, DGS-3130 Series has advised administrators to disable DDP to eliminate the primary known attack vector, remove unnecessary or default SNMP community strings, and restrict SSH, web UI, and SNMP access to isolated management networks and designated admin hosts.
In September, DGS-3130 Series alerted customers about a maximum-severity zero-day, tracked as CVE-2026-86296, which has a public proof-of-concept (PoC) exploit and no patch, affecting legacy DIR-822A dual-band Wi-Fi routers.
Who is affected
Anyone using the DGS-3130 Series is at risk, particularly in environments where the series is actively deployed rather than just licensed or installed but unused.
These switch models offer multi-gigabit uplinks to help enterprise network administrators eliminate data bottlenecks, and they are primarily designed for small-to-medium businesses (SMBs) and metro Ethernet deployments.
Successful exploitation could enable attackers to access sensitive device data, make unauthorized changes to credentials or configurations, leak SNMP communities, or lead to service disruptions and device resets.
Why it matters
The advisory highlights the tangible security impact an attacker could achieve once they exploit the vulnerable path.
The zero-days affect multiple firmware versions of the DGS-3130-30TS, and the company is still assessing the impact on other DGS-3130 Series switching platforms and their firmware security mechanisms, including SSH service security configuration and safeguards for operating-system credentials and firmware encryption.
Consider utilizing a 14-day read-only scan of Microsoft 365 or Google Workspace to identify potential vulnerabilities, without making MX changes.
Technical details
This vulnerability is tracked as CVE-2026-86296 and is rated with medium severity, which is the identifier to reference when reviewing vendor guidance.
Arista has released patches for a new VeloCloud Orchestrator zero-day exploited in attacks, while PHP has warned administrators about two critical flaws with emergency patches expected soon.
Response
DGS-3130 Series has also recommended that administrators maintain offline backups of switch configurations and monitor device logs for any unexpected configuration changes, unprompted reboots, or factory resets.
What security teams should do
Verify whether the DGS-3130 Series is present in your asset and software inventory.
No exploitation has been reported yet, but this status may change, so continue to monitor vendor guidance as you work on remediation.