A hotel VPN appliance is missing several published security fixes and is still exposed to the internet. Which security term describes that unpatched appliance?
Select an answer to reveal the explanation.
Short Explanation
An unpatched appliance is an unlocked window, and the name for that weakness is a vulnerability. You still have a hole whether or not anyone has climbed through it yet. The break-in method, the person who might try it, and the chance they succeed are different words in the same story.
Full Explanation
A vulnerability is a weakness that could be used against a system. Missing published fixes on an internet-exposed VPN appliance are that weakness, even on a day nobody is attacking. An exploit is the method that takes advantage of the weakness. The missing fixes are what an exploit would use, not the exploit itself. A threat actor is the person or group that might attack. The appliance can be vulnerable with no actor named in the ticket. Risk is the tempting twin because an unpatched VPN is risky. Risk is the likelihood and impact of the weakness being used, not the weakness itself. Exam caveat: a scanner finding is evidence of the vulnerability. The exploit is what a tester might run next, under authorization. Operational check: match the appliance version to the vendor's fix list, schedule the missing fixes, and confirm the management page no longer lists them as absent. Record the missing fixes as vulnerabilities in the ticket, separate from any exploit a test might run later. Schedule the fixes in a change window, and do not call the appliance a risk score instead of a vulnerability.