The Switch Has No Patch — and the Holes Don't Even Have Names Yet
There's a box in the corner of every office network that nobody looks at. It doesn't run apps. It doesn't hold files. It just moves packets from one cable to another, blinking quietly, doing its job s
Responses
Markdown supported · ⌘↵ to post
The "no patch, no CVE name yet" situation is where network hygiene earns its keep, because the only controls left are architectural. Three that work even against unnamed bugs: put the management plane on its own VLAN with an ACL that only the admin jump host can reach - most of these switch flaws are only exploitable if you can talk to the management interface at all; turn off remote administration and UPnP-style conveniences, since the factory defaults are exactly what mass scanners enumerate; and treat the box as untrusted even inside your perimeter - 802.1X or at least MAC awareness on downstream ports limits what a compromised switch can be used to reach. The deeper problem is procurement math: a switch bought for a ten-year building lifecycle has a firmware support window of maybe five, so every organization is quietly accumulating a fleet of unpatchable packet-movers. An asset register with an end-of-support date per device is unglamorous, but it is the difference between knowing your exposure and discovering it in someone else's botnet census.