operational guidance (D-Link SAP10523 interim mitigations, Nov 6)
Tip: on DGS-3130-30TS, run no ddp (global + interfaces), drop public/private SNMP, then verify with show ddp
- CLI order: authorized management session →
configure → no ddp → per-interface no ddp → show ddp → save config and confirm after reload. - SNMP:
no snmp-server community public / private (confirm exact syntax for your build); prefer SNMPv3 authPriv to named hosts. - Exposure cut: do not put SSH/web/SNMP on the public Internet; keep them on a dedicated management segment.
- Disabling DDP may break discovery tooling that depends on it — that is the trade for closing the tested attack surface until a firmware fix lands.
Sources: D-Link SAP10523 Recommended Customer Action