Objective 2.3: Explain various types of vulnerabilities

Cert: CompTIA Security+ (SY0-701) Domain: 2.0 Threats, Vulnerabilities, and Mitigations Weight: ~22% of SY0-701 (Domain 2 total) Depth: Explain. Be able to name each vulnerability category, give a real example, and describe in plain English what an attacker could do with it. Recognize CVE (Common Vulnerabilities and Exposures) entries and CVSS (Common Vulnerability Scoring System) severity bands.

What this objective tests

You should be able to read a vulnerability disclosure or a scanner finding, name the SY0-701 category it falls into, and explain what the weakness allows an attacker to do. Sec+ does not ask you to write exploits. It asks you to recognize the family. Triage speed in a SOC (Security Operations Center) comes from the analyst who can say "that is a web vulnerability, specifically SQL injection" before the page finishes loading. This objective is the bridge between SP-2.1 threat actors (who attacks) and SP-2.4 malicious activity (what they do once they are in). Vulnerabilities are the gaps in between.

Key facts

Threat vs vulnerability vs risk

Sec+ keeps these three words on a leash. Mix them up on the exam and you will lose points.

A threat acts on a vulnerability to create a risk. Anti-malware lowers likelihood. Backups lower impact. CVE tracking and patching close the vulnerability itself.

Application vulnerabilities

SY0-701 calls out four application families.

• Memory injection. Attacker code is pushed into a running process's memory. The process executes it as if it were its own.
• Buffer overflow. A program accepts more data than the buffer holds. The extra spills into adjacent memory. If the spill lands on a return address or function pointer, the attacker controls what runs next. Stack and heap overflows are both in this family.
• Race condition. A timing flaw. The classic pattern is TOCTOU (Time of Check to Time of Use): the program checks whether a file is safe, then opens it, but the file changed in between.
• Malicious update. A software update that was tampered with so it installs attacker code instead of the legitimate patch. SolarWinds Orion (late 2020) is the canonical case.

Operating system vulnerabilities

The operating system is enormous, so it ships flaws on a steady cadence. Windows Patch Tuesday exists for this reason. macOS and Linux follow similar cycles. An OS vulnerability that is no longer patched (because the version is past end-of-life) becomes a permanent open door. Server 2012 went out of mainstream support in October 2023. Every CVE published against it since then has no fix.

Web-based vulnerabilities

Two web flaws dominate the exam. Both share the same root cause: trusting user input.

XSS comes in three flavors students should recognize: stored (saved in the database, served to every viewer), reflected (echoed back from a URL parameter), and DOM-based (manipulated entirely in the browser by client-side JavaScript). The exam usually does not demand the flavor name, but the underlying recognition that "script runs in another user's browser" is XSS is high yield.

Hardware vulnerabilities

Three flavors carry the bulk of the exam weight.

• Firmware. The low-level code that controls a piece of hardware. BIOS or UEFI on a PC, the operating system inside a router or switch, the controller chip in a printer. Firmware flaws are hard to patch because the update workflow is unfamiliar to most administrators and the devices are often forgotten.
• End-of-life (EOL). A product whose vendor stopped shipping security updates. Anything from a Windows release to a network appliance to a vendor-specific endpoint agent. EOL devices accumulate CVEs forever.
• Legacy. Hardware that is still in production but nobody fully understands. The institutional knowledge left when the original engineer did. Legacy is a documentation and ownership problem as much as a code problem.

Virtualization vulnerabilities

Sec+ pulls out two specific patterns.

• VM escape. An attacker breaks out of a guest virtual machine and lands on the host hypervisor. From the host, the attacker can read memory and disk belonging to every other guest on the box. Hypervisor vendors (VMware, Microsoft Hyper-V, KVM, Xen) ship advisories whenever a new escape path is found.
• Resource reuse. Memory or storage that belonged to one tenant gets reassigned to another tenant without being wiped. The new tenant reads leftover data. The problem is acute in multi-tenant cloud environments where the underlying hardware is shared.

Cloud-specific vulnerabilities

Cloud vulnerabilities are usually configuration vulnerabilities with a cloud twist. The common ones to recognize:

• Shared responsibility confusion. The customer assumed the cloud provider would patch a layer. The provider assumed the customer would. The layer never gets patched.
• Public storage buckets. S3 (Amazon), Azure Blob Storage, Google Cloud Storage objects left readable to the public internet.
• Over-permissioned IAM (Identity and Access Management) roles. Wildcard policies that grant more than the role needs. A compromise on the role then becomes a compromise of the whole account.
• Unmanaged or orphaned resources. Spun up by a developer who left, never tagged, never patched, never noticed until a scanner finds them.

Supply chain vulnerabilities

Three providers, three attack surfaces.

The fix is the same in all three cases: validate signatures, monitor build pipelines, hunt for anomalous traffic from trusted vendors, and keep a software bill of materials (SBOM) so you can find affected components quickly when a disclosure lands.

Cryptographic vulnerabilities

Sec+ Domain 1.4 sets up the crypto. Domain 2.3 asks where it goes wrong.

• Weak algorithm. DES (single key, 56-bit), 3DES, MD5 used for signing, SHA-1 used for signing, RC4. None should be used for new design. CVE entries for products that still use them appear regularly.
• Short key length. 1024-bit RSA is below current recommendations. 80-bit symmetric keys are too short. NIST publishes minimum key length guidance.
• Bad random number generation. Predictable session tokens, weak nonces, IVs (Initialization Vectors) derived from a system clock. If the random numbers are predictable, the crypto is broken even if the algorithm is fine.
• Reused IV or nonce. Stream ciphers and authenticated encryption modes break catastrophically when the same key plus the same nonce is used twice.

Misconfiguration

The largest category in real-world incidents and the one the exam loves to test in scenario form. The patterns repeat across products.

• Default passwords left on.
• Cloud storage set to public.
• Remote Desktop or SSH exposed to the public internet.
• No MFA (Multi-Factor Authentication) on the admin account.
• Verbose error pages that leak stack traces or version numbers.
• Disabled logging on a high-value system.
• Sensitive ports open by default and never closed.

Misconfiguration is the bread and butter of vulnerability scanners and cloud security posture management (CSPM) tools. It is also the easiest to fix once it is found, which is why audits spend most of their time here.

Mobile device vulnerabilities

Two specific behaviors carry the weight.

• Sideloading. Installing an app on a mobile device from outside the official app store. Bypasses the platform's app review and signature checks.
• Jailbreaking (iOS) or rooting (Android). Removing the manufacturer restrictions so any code can run with elevated privileges. Disables many of the protections that make mobile devices safer than desktops.

Enterprise mobile policies typically block both with MDM (Mobile Device Management). Sec+ rarely asks how either is done. It asks why both matter for security posture.

Zero-day vulnerabilities

A zero-day is a vulnerability that has no public patch available yet. The vendor has zero days of head start. The defender's only options are detection, compensating controls, or taking the affected system offline until a fix ships. Recent canonical cases include Log4Shell (CVE-2021-44228, disclosed December 2021) and the iOS exploit chains used by Pegasus.

Zero-day status is temporary. The moment the vendor ships a patch, the CVE moves from zero-day to standard patching workload. Most CVEs were never zero-days at disclosure time, because the vendor coordinated the disclosure with the patch release.

CVE and CVSS in plain English

Two acronyms drive how vulnerabilities are tracked in the wild.

• CVE (Common Vulnerabilities and Exposures). A public ID assigned to each distinct known vulnerability. Format: CVE-YYYY-NNNNN. The CVE program is run by MITRE. Entries are published on the NVD (National Vulnerability Database) at nvd.nist.gov. Scanner findings, vendor advisories, and threat intel feeds all reference CVE IDs.
• CVSS (Common Vulnerability Scoring System). A 0.0 to 10.0 severity score attached to most CVEs. Higher is more dangerous. Severity bands are Low (0.1 to 3.9), Medium (4.0 to 6.9), High (7.0 to 8.9), Critical (9.0 to 10.0). The score is driven by base metrics like attack vector (network, adjacent, local, physical), attack complexity (low or high), privileges required (none, low, high), and user interaction (none or required).

A real-world triage example. A scanner reports CVE-2024-1234 against a web server. The analyst pulls the NVD page, sees a CVSS base score of 9.8 Critical, sees attack vector Network and privileges required None, and immediately moves the finding to the urgent queue. Compare that to a 5.4 Medium that requires local privileges and user interaction. Same scanner output, very different triage.

The exam does not ask CVSS math. It asks recognition. A 9.0+ score means drop other work. A score combined with internet exposure and sensitive data means the urgent queue gets shorter. A CVE that appears on the CISA Known Exploited Vulnerabilities (KEV) catalog means an attacker is using it right now in the wild.

Common gotchas

• Mixing up threat and vulnerability. A threat is the who. A vulnerability is the weakness. A risk is the calculation. The exam writes scenarios that bait the wrong word.
• Calling a zero-day "a vulnerability that was patched today." Wrong direction. A zero-day has no patch available yet. The vendor has zero days of head start. Once a patch is out, the CVE is no longer a zero-day.
• Treating SQLi and XSS as the same thing because both are "web." SQLi attacks the database. XSS attacks the browser of another user. Different root cause, different fix.
• Forgetting that end-of-life applies to both hardware and software. A Windows release at EOL is the same defense gap as a router model whose vendor will not ship more firmware. Both stop getting CVE fixes.
• Skipping the misconfiguration category because it is "easy." Real-world incidents are dominated by misconfiguration. The exam writes scenarios about public buckets, default passwords, and missing MFA constantly.
• Mistaking CVSS for risk. CVSS measures severity. Risk also depends on whether the vulnerability is internet-exposed, whether the affected asset holds sensitive data, and whether the vulnerability is actively exploited. A 6.5 on an internet-facing public portal can beat a 9.5 on an isolated lab machine.
• Thinking supply chain only means software. Sec+ tests all three providers: service, hardware, and software. A managed service provider compromise reaches every client. A counterfeit hardware component carries an implant. A hijacked update pipeline ships attacker code as a trusted patch.
• Reading "jailbreaking" as an attack. Jailbreaking is a vulnerability state created by the user. The attack happens after, when malicious apps can run without the platform protections.

Real-world context

In a SOC Tier 1 analyst seat, vulnerability work shows up three ways: a SIEM (Security Information and Event Management) alert names a CVE, a scanner ticket lands with findings on multiple servers, or a threat intel feed warns about active exploitation. The analyst places each one in a category, checks the CVSS, finds affected systems through the asset inventory, and routes the fix through change management (SP-1.3).

Sample walkthrough. The intel feed flags a CVE against a Java logging library used by a patient portal at a regional healthcare network. CVSS 9.8 Critical, attack vector Network, privileges required None. The analyst recognizes application (memory injection via JNDI lookup) plus supply chain (third-party library), opens an emergency change request to patch the affected servers in a staged rollout, and adds a compensating control (block outbound traffic to the JNDI provider) until the patch lands.

Mature shops also pull the CISA KEV (Known Exploited Vulnerabilities) catalog every morning. Anything on KEV that touches a company asset jumps the queue regardless of CVSS, because an attacker is using it now. Cyber insurance underwriters increasingly ask for KEV monitoring and patch time targets at renewal.

A vulnerability analyst owns the full lifecycle: scan, prioritize by CVSS plus business context, patch through change management, verify with a rescan, report up and down. The Sec+ categories drive ownership and speed at every step.

Sources

• CompTIA Security+ SY0-701 Exam Objectives, Section 2.3
• NIST SP 800-40 Rev. 4, Guide to Enterprise Patch Management Planning
• NIST SP 800-53 controls RA-5 Vulnerability Monitoring and Scanning, SI-2 Flaw Remediation, CM-6 Configuration Settings
• MITRE CVE program and the NVD (nvd.nist.gov)
• CISA Known Exploited Vulnerabilities (KEV) catalog
• OWASP Top 10 (web vulnerability priorities)
• OWASP Mobile Top 10 (mobile-specific vulnerabilities)
• NIST SP 800-207, Zero Trust Architecture (for context on shared responsibility and IAM)