OPSWAT. Unit 515
Network Security · Vulnerability research

From a lobby account to a switch that will not boot: four Catalyst 9300 CVEs

A low-privilege web account on an enterprise access switch can climb one privilege level and then push the device into maintenance mode, where it may need someone on site to recover it.

  • CVE-2026-20110
thanhlocpandaSenior Security Researcher · Mar 25, 2026 · 1 min read
On this page

Summary

Two of the four issues chain together. The first lets a restricted web user run commands with a higher privilege level; the second abuses that level to switch the device into a maintenance state.

CVEWeaknessImpact
CVE-2026-20110Privilege escalation chain to maintenance modePersistent DoS

Why it matters

Access switches rarely get the same scrutiny as firewalls, yet they sit in every wiring closet. A switch that cannot recover remotely turns a software bug into a site visit.

Cisco has released fixed software. Administrators should also review which accounts can reach the web UI.

Tags
  • Network
  • Privilege escalation

About the author

thanhlocpanda

Senior Security Researcher

Leads Unit 515 research on industrial controllers and network infrastructure, from firmware teardown to coordinated disclosure with vendors.

Keep Reading

More vulnerability deep dives from Unit 515.

Oct 16, 2026 | IoT & Embedded SecurityChaining a replayed login into full control of a home camerainsominaRead More →Feb 26, 2026 | Network SecurityTesting public exploit claims for an SSO authentication bypasstheblackturtleRead More →Jul 29, 2025 | Application SecurityHow an incomplete patch left a dashboard account takeover openinsominaRead More →
View all research

Stay Updated on Unit 515 Research

Get updates on vulnerability discoveries, technical analyses, and the latest research from OPSWAT Unit 515.

Subscribe