700 Series Switch EUVD-2026-95815

Requires physical access to the Red Lion 700 Series switch and the ability to trigger a boot from factory settings, which bypasses the administrator's configured authentication. Exploitation further depends on the default administrative credentials remaining valid/unchanged on first factory boot. Limiting factors: no network path exists (AV:P - hands-on access mandatory), so remote exploitation is impossible; the attacker needs the device's default credentials; and sites that physically secure switch hardware (locked cabinets, controlled OT areas) substantially mitigate this.

Real-world risk is moderate and heavily constrained by the attack vector. The provided CVSS 4.0 vector (AV:P/AC:L/AT:N/PR:L/UI:N) confirms this requires PHYSICAL access to the device, which is the single most important limiting factor - it cannot be exploited remotely or over the network, so mass or opportunistic exploitation is not feasible. No EPSS score, KEV listing, or POC was provided in the input, and the vulnerability is not on CISA KEV, so there is no public exploit identified at time of analysis. The impact signals are real (VI:H/SI:H integrity impact - attacker achieves persistent configuration tampering) but the base score of 6.8 (MEDIUM) accurately reflects that physical presence plus use of default credentials gates the attack. This is a legitimate concern for OT/ICS environments where switches sit in physically exposed locations (substations, factory floors, remote cabinets), but for most threat models it is a lower priority than a network-exploitable flaw. Note a minor signal conflict: the input Tag labels this 'Information Disclosure,' yet CWE-288 and the vector's dominant integrity impact (VI:H/SI:H vs only VC:L/SC:L) indicate this is primarily an authentication-bypass and configuration-tampering issue, not disclosure - treat the tag with caution.

An attacker with physical access to a Red Lion 700 Series switch boots the device from factory settings, bypassing the configured authentication, then logs in using the unchanged default administrative credentials. They modify and save the configuration so the malicious settings persist across subsequent normal reboots. No public exploit code is known; the attack requires hands-on physical access and knowledge of the default credentials.