D-Link is urging DGS-3130-30TS administrators to disable D-Link Discovery Protocol (DDP) while it investigates unpatched vulnerabilities. Its November 6 interim bulletin, SAP10523, identifies hardware revision B1 as the tested device.
Examined firmware includes 2.00.B014, 2.00.B034, 2.04.000 and 2.04.001; individual findings may affect different subsets. Other DGS-3130 models and switching platforms remain under investigation. Their inclusion does not establish that they are vulnerable.
According to D-Link, researcher Giresh Kumar Enugu demonstrated exploitation in controlled testing. Potential consequences include sensitive-information disclosure, unauthorized administrative changes and disruption. The bulletin does not establish exploitation in the wild. Public CVE records and a confirmed corrective-firmware release date were unavailable.
Check both global and interface settings
The official CLI reference documents no ddp in global and interface configuration modes. It describes different defaults: DDP disabled globally but enabled on physical ports. Administrators should inspect the actual configuration rather than infer the port settings from a global default. The manual’s show ddp examples display global state and the state of a selected interface; its configuration-saving instructions explain how to preserve running changes in the startup configuration.
There is also a useful boundary to understand: the manual says a port with DDP disabled stops generating or processing DDP messages but still floods received messages within its VLAN. Disabling that client therefore should not be interpreted as filtering all DDP traffic from the wider network segment.
D-Link also recommends removing unnecessary/default SNMP communities, restricting management access and retaining configuration backups. The researcher reported that disabling DDP blocked tested DDP attack paths; D-Link was independently reviewing the mitigation. This does not correct separate firmware-security findings involving SSH configuration, operating-system credentials and cryptographic material.
Source note: SAP10523 was reviewed through its complete indexed copy. The live advisory page was unavailable when checked.
