A vendor releases a patch for a critical CVE on the city's WLAN controllers. What is the appropriate mitigation when a fix exists?
Select an answer to reveal the explanation.
Short Explanation
When the vendor hands you a patch for the city controllers, use it. Wiki notes and cosmetic renames are not a substitute for fixing the hole.
Full Explanation
When a vendor releases a patch for a critical CVE on the city's WLAN controllers, the appropriate mitigation when a fix exists is to apply the vendor patch or upgrade path to mitigate the known WLAN infrastructure vulnerability. Patching is the primary control once a fixed release is available and tested. Ignoring the patch and relying solely on renaming management interfaces provides no real remediation and may break operations without reducing exploitability. Documenting the CVE in a wiki and postponing all upgrades indefinitely without compensating controls leaves a known critical hole open. Disabling RADIUS accounting only does not remediate controller remote code execution issues and harms visibility. Municipal change management should accelerate critical wireless controller patches with testing in a lab or canary site, then fleet rollout. Exam caveat: if immediate patching is blocked, use documented compensating controls temporarily—but the best mitigation when a fix exists remains applying the patch. Operational check: identify fixed controller code versions, test on a non-production or canary pair, schedule the approved change window, verify post-upgrade SSID and AAA health, and close the vulnerability ticket with version evidence.