CVE-2026-33272

MEDIUMCVSS 4.9

Description

A malicious user with physical access to the device can boot the switch from factory settings without authentication, use the default administrative credentials to obtain administrative access, and save changes to the configuration file so that they persist next time the switch boots normally.

Timeline

Published:October 9th, 2026 3:17 PM

Last modified:October 11th, 2026 5:17 PM

CVSS Scoring

CVSS v3: 4.9 (MEDIUM)

CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Weaknesses (CWE)

CWE-288

References & Reports

Advisories, patches, and third-party reports

https://github.com/cisagov/CSAF/blob/develop/csaf_files/OT/white/2026/icsa-26-281-01.json
https://www.cisa.gov/news-events/ics-advisories/icsa-26-281-01
https://www.hms-networks.com/
https://www.hms-networks.com/cybersecurity

Source: NIST NVD · Data may lag official sources by up to one minute