A small switch tucked under a desk can look harmless. It connects a printer, a couple of workstations and perhaps a device nobody remembers installing. But when that switch is unmanaged, poorly documented or running with default credentials, it can become part of a much bigger security problem.
There is an important distinction: a genuinely unmanaged switch usually has no configuration interface and therefore no administrator password to guess. The risk often comes from devices described as “unmanaged” that are actually smart or web-managed switches, from management features enabled by default, or from a managed switch that has been deployed and then forgotten. Attackers do not care much about the label on the box. They care about what they can reach, change or use as a stepping stone.
This article explains how those weaknesses can help an attacker gain access or move through a network, why physical infrastructure is part of cybersecurity, and what practical controls reduce the risk. The short version: default credentials matter, but the wider unmanaged switches risk is usually a combination of weak access controls, poor segmentation and a lack of visibility.
First, what do we mean by an unmanaged switch?
An unmanaged switch is designed to work without configuration. It learns which devices are connected to its ports and forwards Ethernet frames accordingly. That simplicity can be useful in a small, controlled environment. It also means the device may offer little or no visibility, access control or protection against misconfiguration.
Other products sit between unmanaged and fully managed. They may be called smart, web-managed or easy-managed switches and offer a browser interface, limited VLAN support or basic monitoring. If such a device has a management interface, it may have credentials, a default IP address and services that need securing. A fully managed switch also has those responsibilities, with more configuration options—and more ways for an incorrect design cyberdaily.au to cause trouble.
Check the actual model and documentation rather than relying on a product category or a colleague’s memory. A device may have been swapped during an office fit-out, inherited from a previous tenant or connected years ago to solve a short-term problem. Mystery cables and mystery switches are both security smells.
How attackers take advantage
1. They discover an exposed management interface
An attacker who already has a foothold on a network may scan for devices that respond to common management services. If a smart or managed switch exposes a web interface, SSH, Telnet or another administration service to user networks, that interface gives the attacker something to investigate. They may identify the device, test known weaknesses or try credentials that are publicly documented or commonly left unchanged.
Default credentials are particularly dangerous because they turn a configuration oversight into a predictable access path. If the attacker can reach the management interface and the password has not been changed, they may be able to view or alter the switch configuration. The risk is not limited to a switch with “admin/admin” as its password: reused passwords, shared support credentials and accounts nobody owns can create similar openings.
A genuine unmanaged switch may not offer this route. But it can still create exposure by connecting devices into the wrong part of the network, or by giving an attacker an extra physical port in a space that should not provide network access. The absence of a password does not mean the absence of risk.
2. They use the switch to expand access
If an attacker can change a capable switch’s configuration, they may try to create or alter a VLAN, change which ports belong to it, or affect how traffic reaches other parts of the network. The exact options depend on the hardware, firmware and network design. On a basic unmanaged switch, an attacker generally cannot configure VLANs through the device itself; however, connecting it to an existing access port can still extend that port’s network to multiple devices.
That distinction matters. A small switch plugged into a corporate access port may give several unauthorised devices access to the same segment. If the port is on a sensitive or broadly trusted network, the switch has effectively multiplied the number of possible entry points. If the port is connected incorrectly on both ends, it can also introduce a loop or other fault that disrupts service.
3. They exploit weak segmentation to enable lateral movement
Once inside one network segment, an attacker will often look for other systems they can reach. This is lateral movement: progressing from an initial foothold towards higher-value devices, accounts or services. Poor segmentation makes that journey easier. If workstations, servers, building systems, printers and operational technology can all communicate freely, a compromised low-value endpoint may have an unnecessarily broad path through the environment.
Switching is one of the foundations of segmentation. Firewalls can enforce boundaries between networks, but they cannot compensate for every badly designed Layer 2 segment, every misassigned port or every unmanaged switch that bridges devices into the wrong place. Effective segmentation depends on capable switching, a clear design, correct configuration and regular validation.
For example, a business might intend to keep facilities equipment separate from corporate laptops. If an unmanaged switch is added to a corporate port in a plant room, devices connected through it may inherit access to the corporate segment. If a managed switch has a default password and an exposed management interface, an attacker may have a route to tamper with the boundary itself. These are different failure modes, but both can undermine the intended design.
4. They take advantage of poor visibility
Unmanaged switches often provide little useful telemetry. Security teams may not be able to see which device is connected to which physical port, when a new endpoint appeared, or whether a port is carrying unexpected traffic. That makes investigation slower and detection harder.
Endpoint detection platforms can help identify suspicious activity on monitored computers and servers, such as unusual process behaviour or credential access. They do not, by themselves, tell you that an unauthorised switch was installed behind a reception desk. Similarly, firewalls can log traffic crossing the boundaries they control, but may not see conversations that remain within the same Layer 2 segment. Network monitoring, access control and reliable physical records are needed to fill those gaps.
Why the physical layer is a cybersecurity concern
Physical infrastructure is not separate from cybersecurity. Cabling, patch panels, wall outlets, switch ports and comms rooms determine where devices can connect and what network they can reach. An exposed port in a public area, an unlocked cabinet or an undocumented link between floors can defeat assumptions made in a logical network diagram.
Physical-layer faults can also create outages and security blind spots at the same time. A loop, damaged cable or wrongly patched link may cause intermittent connectivity or broadcast storms. During the response, teams may disable monitoring, move devices or add a temporary switch to restore service. If those changes are not documented and reviewed, an emergency workaround can become a permanent weakness.
That is why I keep a label maker in my laptop bag. A labelled patch panel is not a cybersecurity control on its own, but accurate labelling helps engineers trace connections, investigate unexpected devices and restore service without guesswork. “It’s just cabling” is how a mystery link ends up carrying production traffic.
Default credentials: a small oversight with a large blast radius
Changing default credentials is basic hygiene, but it should be part of a broader lifecycle. Identify the device, confirm who owns it, remove accounts that are not required, use unique credentials and restrict management access to approved administrative systems. Where supported, use central authentication and multifactor authentication for management access. Disable insecure services and keep firmware maintained through a controlled process.
Do not assume that a device is safe because it is old, simple or difficult to find in a spreadsheet. In particular, check for:
- Switches with web or command-line management enabled, including “smart” models treated as unmanaged. Default, shared or reused administrator credentials. Management interfaces reachable from ordinary user or guest networks. Unauthorised mini-switches connected to wall ports or installed in cabinets. Ports that provide access to sensitive systems without authentication or approval. Unknown firmware versions, unsupported hardware and configurations with no accountable owner.
Build a network that can contain a compromise
A useful design assumes that some endpoint will eventually be compromised. The aim is to limit what it can reach, make unusual behaviour visible and give responders a reliable way to isolate the problem.
Design segmentation deliberately
Separate networks according to purpose and risk—for example, corporate users, guests, servers, voice, facilities systems and operational technology. Use managed switching where you need VLANs, port-level controls, monitoring or central configuration. Apply firewall rules between segments that allow only necessary traffic, rather than treating a VLAN as a complete security boundary by itself.
Document where Layer 2 domains begin and end, which switch ports are trunks, and which devices are permitted on each segment. Restrict switch management to a dedicated management network or approved administration hosts. Test the design: confirm that a guest device cannot reach internal services, and that a normal workstation cannot talk directly to systems that should be isolated.
Control physical access and connection points
Lock communications cabinets and restrict access to network rooms. Disable unused ports where practical, and consider port security or network access control to limit what can connect. In higher-risk environments, monitor for unexpected switches and unauthorised devices. Keep an accurate inventory that includes location, model, firmware, management status, owner and support arrangements.
Vendors offer different options for different environments. Cisco has a broad range of managed enterprise switching products and features; MOXA supplies industrial networking equipment used in settings where environmental and operational requirements can be demanding; Garland Technology is known for network visibility and packet-broker solutions. Those examples are not interchangeable, and a brand name does not make a design secure. Select equipment that fits the operational need, then configure, maintain and monitor it properly.
Make monitoring useful during an incident
Combine endpoint detection platforms with firewall logs, switch telemetry and network monitoring. Where possible, collect authentication and configuration-change events from managed switches. Alert on management access from unexpected networks, new devices appearing on sensitive segments and unusual traffic between zones. Keep diagrams and port records current enough that an incident responder can trace a device without spending the first hour guessing.
Practice isolating a compromised endpoint and tracing its physical connection. Confirm who can authorise a port shutdown and what the operational impact would be. In a production or OT environment, an immediate disconnection may be unsafe; the response plan needs to account for process and safety requirements.
How ACSC guidance fits in
Australian Cyber Security Centre guidance, including the Essential Eight and broader network security advice, is most effective when the underlying environment is understood and maintained. Security controls rely on dependable foundations: known assets, controlled administration, sensible network boundaries and the ability to monitor and respond. No guidance can compensate for an unknown switch bridging two networks or a management interface nobody knows is exposed.
Use ACSC material as a framework for improving security, not as a substitute for engineering the network properly. Map your environment, identify unsupported and unmanaged devices, remove default credentials where management exists, and verify that segmentation works in practice. Then make those checks part of change management and regular assurance.
What happens at 2am when this fails?
That is the question worth asking before an outage or incident. Can the on-call engineer identify the switch, find its owner, trace its uplink and determine which services depend on it? Is there a safe way to isolate a suspicious port? Are the credentials stored securely and available to the right people? If the answer is “we’ll work it out”, the network needs better records and a clearer recovery plan.
Unmanaged switches are not automatically malicious, and a genuine unmanaged model does not necessarily have default credentials. The danger is allowing unknown or poorly controlled equipment to sit inside a network whose trust boundaries depend on it. Attackers can exploit exposed management access, use extra connectivity to find a foothold, and take advantage of weak segmentation for lateral movement. Good switching, physical controls, monitoring and documentation reduce those opportunities—and make failures less mysterious when they happen.