Building-badge door controllers still run firmware last updated years ago, and the vendor has published critical fixes the city never applied. Which vulnerability class is primarily involved?
Select an answer to reveal the explanation.
Short Explanation
Badge controllers stuck on ancient firmware are a hardware/firmware vulnerability — physical access gear with a software underbelly that never got patched. Web XSS and SQLi live elsewhere. Inventory and update facility controllers like any other critical system.
Full Explanation
Hardware and firmware vulnerabilities arise when device firmware is outdated and missing published critical fixes. Building-badge door controllers that have not been updated for years leave physical-access systems exposed to known flaws in embedded software. Facility controllers are computers with long upgrade cycles; treating them as "just locks" ignores firmware as an attack surface that can yield unauthorized entry or persistence near civic spaces.
Cross-site scripting on a citizen-comment portal injects browser script. It does not describe stale door-controller firmware.
SQL injection in a building-permit web form manipulates database queries. Badge controllers’ unpatched firmware is a different asset and vulnerability class.
Watering-hole compromise of a procurement discussion site infects visiting browsers via a trusted web community. Firmware neglect on door hardware is local device hygiene, not a poisoned forum.
Exam caveat: Firmware/hardware vulnerabilities are distinct from OS patching on PCs and from web app flaws. Controllers, IoT, and facility devices often fall out of IT patch cadences—exam stems highlight "years ago" firmware and vendor fixes never applied. Physical impact (doors, badges) can still be a cyber vulnerability class.
Operational check: inventory all badge controllers and related IoT, subscribe to vendor advisories, schedule firmware maintenance windows, segment facility networks from general staff LAN, and monitor controller management interfaces. Replace devices that can no longer be patched. Physical security and cybersecurity teams must share ownership of door firmware risk.