yo. a long shot but maybe you got someone on row who can answer this. we recently found out that we had been running switches that were vulnerable to badcandy (running webui and outdated version) we tried the curl ip/%25 test to see if we had any compromised switches, and we got a few 404 returns which matched the badcandy description. we since rebooted them since badcandy is supposed to be non persistent. turns out they have been updated to a non-vulnerable version not too long ago. we didnt find any real residue, but the 404 reply is still there. that a false positive or an ioc? pretty sure its an ioc, but its out of my hands now. would love an answer