The same AP CVE appears on a closed city IT lab WLAN and on production stadium Wi-Fi serving tens of thousands of fans. How should risk differ?
Select an answer to reveal the explanation.
Short Explanation
Same bug, different blast radius. A quiet lab AP is not a packed stadium bowl—criticality and how many people ride that WLAN change the city's risk score.
Full Explanation
When the same AP CVE appears on a closed city IT lab WLAN and on production stadium Wi-Fi serving tens of thousands of fans, risk should be rated higher for production stadium Wi-Fi due to greater asset criticality and user population scale. Identical CVE identifiers do not imply identical organizational risk; exposure, constituency size, and operational impact differ. Rating them identically because the CVE string matches ignores environmental context. Rating the lab higher because lab SSIDs use longer passwords confuses a compensating control on a low-value network with production blast radius. Rating neither until every fan device is individually fingerprinted is an impractical delay. Stadium and large-venue civic Wi-Fi typically warrants faster patching, tighter monitoring, and clearer communications plans for the same code flaw. Exam caveat: environmental risk scoring adjusts for asset criticality and population even when the CVE ID is shared. Operational check: prioritize stadium controllers and APs for the fixed code train, enhance WIPS/monitoring during events, document lab as lower environmental risk with a later window if needed, and brief venue operations on residual risk until patching completes.