D-Link has issued an urgent security warning to users of the DGS-3130 managed network switch series, following the discovery of a set of zero-day vulnerabilities that remain unpatched. These switches are widely used in small and medium-sized enterprises and Metro Ethernet networks due to their ability to support high data transfer speeds.
Vulnerability details
These vulnerabilities were discovered by network engineer Girish Kumar Inugo and are centered on the D-Link Discovery Protocol (DDP), as well as components related to access control and information processing within the switch firmware. Although specific CVE identifiers have not been disclosed at this time, the company confirmed that exploiting these vulnerabilities could grant attackers broad privileges, including:
- Access to sensitive device data.
- Making unauthorized changes to credentials or configuration settings.
- Leaking SNMP information.
- Causing service disruptions or forced device resets.
What should network administrators do?
Given that a security patch is not currently available, D-Link has provided a set of technical recommendations to mitigate the risk of attack:
- Disable the DDP protocol: This is considered the most important measure to close the primary discovered attack vector.
- SNMP management: Remove default or unnecessary SNMP community strings.
- Restrict access: Limit access to the web interface, SSH, and SNMP to isolated management networks and specific hosts only.
- Backup: Maintain off-network backups of switch configurations and regularly monitor device logs to detect any unexpected changes or unexplained reboots.
The company is currently continuing its investigations to assess the impact on other switching platforms and firmware security mechanisms, including SSH service security settings and firmware encryption. This warning comes at a sensitive time, as the company previously warned last September of another critical security vulnerability in older DIR-822A routers.