D-Link warns of unpatched critical zero-day flaws in enterprise switches

Networking equipment manufacturer D-Link has issued a security advisory regarding multiple critical zero-day vulnerabilities in its DGS-3130 series of managed gigabit stackable switches, The 420.in reported. Attackers can exploit these flaws to extract sensitive hardware information, abuse administrative privileges, and alter critical device security configurations. [1]

According to The 420.in, the security flaws also allow attackers to disrupt enterprise network services, trigger unauthorized device reboots, or initiate factory resets. D-Link has not yet released a firmware update to patch these vulnerabilities, leaving network administrators without an official fix. [1]

A zero-day vulnerability is a security hole in a computer system that is unknown to its developers or anyone capable of mitigating it. Until the vendor remedies the flaw, attackers can exploit it in an active attack. [2]

The warning follows similar security incidents affecting enterprise network hardware. As FTMQ Security reported earlier, Zyxel recently released security updates for an actively exploited vulnerability tracked as CVE-2026-107441 in its GS1900 series switches after hackers compromised nearly 1,000 devices. [4]