A critical remote exploit targets internet-exposed cloud WLAN dashboards used by the municipality, while another AP bug is local-only on an isolated management VLAN. How should relative risk be rated?
Select an answer to reveal the explanation.
Short Explanation
Same CVE number on paper is not the same risk in the wild. A cloud dashboard hanging on the Internet is a bigger municipal target than a local-only AP glitch trapped on a locked-down management VLAN.
Full Explanation
A critical remote exploit targeting internet-exposed cloud WLAN dashboards used by the municipality should be rated higher in relative risk than an AP bug that is local-only on an isolated management VLAN, because exposure path and reachability increase likelihood and impact. Internet-facing management planes invite opportunistic scanning and credential attacks against the entire civic wireless estate; an isolated local-only flaw requires deeper foothold. Rating both identically because they share a similar CVSS base discussion online ignores environmental exposure modifiers. Rating the isolated local-only bug higher merely because APs are physically closer to users confuses physical proximity with exploit reachability. Rating neither until a newspaper publishes a human-interest story about Wi-Fi abandons professional risk analysis. Municipal cloud dashboards deserve explicit exposure review whenever critical advisories land. Exam caveat: environmental risk adjusts base severity using reachability, asset criticality, and compensating controls—not headlines alone. Operational check: confirm whether the cloud WLAN dashboard is internet-exposed or VPN/IdP-restricted, apply the vendor fix and MFA/conditional access immediately for exposed consoles, and compare residual risk to the isolated VLAN bug after documenting reachability for both.