Are Businesses Ignoring the Biggest Security Risk in Their Office — Network Switches?
Not the biggest, but one of the most neglected. Phishing, stolen passwords and internet-facing devices such as routers and VPN gateways remain the more common starting points for attacks. Switches, though, are a documented and under-managed part of the attack surface. Cisco has published actively exploited switch flaws with the maximum severity score of 10.0. Cisco Talos found that the Salt Typhoon intrusions, disclosed in 2025, mostly used stolen logins to network devices and then harvested their configurations. And in a typical office, an unmanaged switch under a meeting-room table gives anyone who plugs in a cable direct access to the staff network. The fix is mostly configuration, not expensive hardware.
What are the real switch risks, and what fixes them?
| Risk | Evidence or example | Control |
|---|---|---|
| Exposed web management | Cisco IOS XE web UI flaw CVE-2023-20198, CVSS 10.0, actively exploited from Oct 2023 | Disable the HTTP server where not needed; put management on its own VLAN with access lists |
| Legacy features left on | Cisco Smart Install CVE-2018-0171; Cisco reported "continued exploitation" in Aug 2025 | Disable Smart Install ("no vstack"); patch |
| Stolen or weak credentials, SNMP strings | Cisco Talos, Salt Typhoon analysis, Feb 2025 | Central login (AAA) with MFA, SNMPv3, strong password hashing |
| Rogue device on an open port | Wall ports in meeting rooms and shared offices | 802.1X or MAC authentication, port security, shut unused ports |
| Rogue DHCP server or ARP spoofing | Standard LAN attacks | DHCP snooping and Dynamic ARP Inspection |
| VLAN hopping | Double-tagging on the native VLAN | Don't use VLAN 1 as native; trunk only where needed |
| End-of-life firmware | Talos: replace end-of-life hardware | Keep an inventory; remove or risk-assess unsupported switches |
Source: Cisco security advisories for CVE-2023-20198 (16 Oct 2023) and CVE-2018-0171 (updated 20 Aug 2025); Cisco Talos, "Salt Typhoon analysis" (20 Feb 2025); CSA Cyber Essentials V202503. Hardening controls are standard vendor practice; check your switch's datasheet for support.
Why do switches get ignored?
Because they keep working. A switch that was installed five years ago and never touched still passes traffic, so nobody logs in to it. That's exactly the profile attackers look for: default or shared passwords, firmware that was never updated, management pages reachable from the whole network, and features nobody remembers enabling.
The Cisco cases show how serious that can get. CVE-2023-20198 let an attacker with network access to the switch's web interface create an administrator account. Cisco gave no workaround other than disabling the HTTP server. The older Smart Install flaw affected switches where the feature had been enabled by default in earlier software releases, and Cisco still reported exploitation in 2025, seven years after the fix. In its Salt Typhoon analysis, Talos found the attackers mostly logged in with valid stolen credentials, then copied device configurations to collect SNMP community strings and weakly encrypted local passwords for further access. Their recommendations read like a basic checklist: switch off Smart Install, HTTP and Telnet; use strong password types and SNMPv3; enforce central login with MFA; restrict management protocols with access lists; and replace end-of-life hardware.
These were large enterprise and carrier networks. For an SME, the more likely problem is a flat network with default settings, which makes every other attack easier to spread. We look at forgotten devices more broadly in the most dangerous device in your office might be the one nobody manages.
A switch you never log in to is a switch nobody else should be able to log in to either. Change the password, update the firmware, and take the management page off the staff network.
Is an unmanaged switch safer because there's nothing to hack?
Partly. An unmanaged switch has no management interface, so it can't be taken over the way the Cisco flaws allowed. For a very small office with one network and no visitors, a managed switch left on factory defaults can add attack surface rather than remove it.
The trade-off is that an unmanaged switch can't do anything to protect you. It can't put guests, cameras and printers on separate VLANs, can't block a laptop that isn't yours, and can't stop a rogue DHCP server. Once an office has visitors, shared floors or a meeting room with live wall ports, those controls matter more than the small extra attack surface. The answer is a managed switch that is actually managed. Our posts on switches holding the office back and why switches are becoming computers cover the performance and software side.
What should a Singapore SME do first?
- Inventory. List every switch with model, serial number, location and firmware version. CSA's Cyber Essentials mark expects an up-to-date hardware inventory and removal of assets past end of support. Our post on end-of-life hardware explains how to track support dates.
- Credentials. Change every default password (another Cyber Essentials expectation), stop sharing one admin login, and use SNMPv3 rather than default community strings.
- Management access. Put switch management on its own VLAN and disable web, Telnet and legacy features you don't use.
- Ports. Shut unused ports, and in meeting rooms and reception put live ports on a guest VLAN or require 802.1X. In shared or serviced offices, assume someone can reach a port.
- Segmentation. Separate staff, guests, cameras, printers and building systems. This pairs with the router and firewall steps in why a S$300 router could be costing you thousands.
- Firmware. Schedule updates, and replace switches that no longer get them.
Keep perspective: if your office still lacks MFA on email and Microsoft 365, fix that first. It closes more doors per dollar than any switch upgrade.
Buying in Singapore
Managed switches in stock include the D-Link DGS-1210-28 at S$334.80, the HPE Aruba Instant On 1930 24-port at S$408, the FortiSwitch 108F (managed from a FortiGate) at S$574.80, the HPE Aruba CX 6000 24-port at S$998.40 and the FortiSwitch 124F at S$975.60 (all listed 8 Nov 2026). Cisco Meraki switches such as the MS130-8P are price on request. Features such as 802.1X, DHCP snooping and ARP inspection vary by model, so tell us which controls you need and we'll confirm against the datasheet. Prices change; ask for a current quotation. Use Request for Quotation on the product page, call (65) 6978 3502, email Sales@sourceit.com.sg or use our contact page.
Frequently asked questions
Can a network switch be hacked? Yes. Cisco has published actively exploited flaws in switch software, including a web interface flaw rated CVSS 10.0 in 2023. Stolen or default credentials are an even more common way in.
Is an unmanaged switch a security risk? It has no management interface to attack, but it also can't separate guests from staff, block unknown devices or stop rogue DHCP servers. In offices with visitors, a properly managed switch is safer.
What is 802.1X? A standard that makes a device authenticate before a switch port lets it onto the network. It stops someone plugging an unknown laptop into a wall port and reaching staff systems.
How often should switch firmware be updated? Check for security advisories at least quarterly and apply critical fixes promptly. Replace switches whose vendor no longer releases updates.
Are switches the biggest security risk in an office? Usually not. Phishing, stolen passwords and internet-facing devices are more common starting points. But switches are often the least maintained devices, and a flat, default-configured network makes every other attack easier to spread.
