TFTP Server
A TFTP server you start for one job and stop afterwards.
The switch wants to pull its image from somewhere and you are the somewhere.
CySecTek

Point it at a folder, choose the address to bind to, and start it. Read-only is the default, so a device can pull an image without being able to write anything back. Every request is logged as it happens.
It stops when you stop it. Nothing is installed as a service and nothing survives a restart, which is the behaviour you want from something that exists for twenty minutes on a customer link.
What you walk away with
- Firmware served to equipment that only speaks TFTP
- Read-only by default, bound to the interface you choose
- A live log of what was requested and whether it was found
Where it stops
Stated here rather than discovered on site.
- TFTP has no authentication and no encryption — that is the protocol, not the implementation. Run it on an isolated or trusted link and stop it when the job is done.
- Windows Firewall will normally prompt on first run; without the rule, nothing reaches it.