The "no patch, no CVE name yet" situation is where network hygiene earns its keep, because the only controls left are architectural. Three that work even against unnamed bugs: put the management plane on its own VLAN with an ACL that only the admin jump host can reach - most of these switch flaws are only exploitable if you can talk to the management interface at all; turn off remote administration and UPnP-style conveniences, since the factory defaults are exactly what mass scanners enumerate; and treat the box as untrusted even inside your perimeter - 802.1X or at least MAC awareness on downstream ports limits what a compromised switch can be used to reach. The deeper problem is procurement math: a switch bought for a ten-year building lifecycle has a firmware support window of maybe five, so every organization is quietly accumulating a fleet of unpatchable packet-movers. An asset register with an end-of-support date per device is unglamorous, but it is the difference between knowing your exposure and discovering it in someone else's botnet census.