Security readout for executives and security teams
Plain-English summary
Affected industrial switches used the same built-in SSL/SSH keys across devices. Because users could not regenerate those keys, secure management communications may not be unique or trustworthy. The cited advisory says an attacker could disrupt communication or compromise the system.
Executive priority
Treat this as urgent for industrial networks because compromise of managed switches can affect operational communications. Prioritize exposed or centrally connected switches first, then complete firmware remediation during controlled maintenance windows.
Technical view
CWE-321 hard-coded cryptographic keys affect Red Lion Controls Sixnet-Managed Industrial Switches firmware 5.0.196 and prior, and AutomationDirect STRIDE-Managed Ethernet Switches firmware 5.0.190 and prior. The issue is network reachable, unauthenticated, low complexity, and rated CVSS v3 10.0 in the source bundle.
Likely exposure
Exposure is likely where affected Sixnet or STRIDE managed industrial switches remain on vulnerable firmware, especially with HTTP SSL or SSH management reachable from operational or enterprise networks. The sources do not provide deployment counts or internet exposure data.
Exploitation context
The source bundle does not cite active exploitation, and KEV is false. Risk remains high because the flaw involves shared device keys, no required credentials, no user interaction, and possible confidentiality, integrity, and availability impact.
Researcher notes
Evidence is limited to the CVE record and CISA ICS advisory reference in the bundle. Do not assume broader models, exploit availability, or fixes beyond SLX firmware Version 5.3.174 without vendor confirmation.
Mitigation direction
- Update affected devices to SLX firmware Version 5.3.174.
- Check current Red Lion and AutomationDirect guidance before maintenance.
- Restrict network access to switch management interfaces.
- Prioritize devices reachable across routed or untrusted networks.
- Plan maintenance windows for industrial availability constraints.
Validation and detection
- Inventory Sixnet and STRIDE managed switch models and firmware versions.
- Confirm whether firmware is 5.0.196, 5.0.190, or earlier.
- Review whether SSH or HTTPS management is network reachable.
- Verify upgraded devices report SLX firmware Version 5.3.174 or later.
- Document compensating access controls for unpatched devices.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-321: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2016-9335 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://ics-cert.us-cert.gov/advisories/ICSA-17-054-02CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use of Hard-coded Cryptographic Key
Use of Hard-coded Cryptographic Key represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.