A vulnerability is any potential weakness that can compromise the confidentiality, integrity, or availability of a system or its data. Connectivity, necessary for useful networks, also creates exposure to vulnerabilities. section 11.1.2 section 11.0
Separate vulnerability from the related security terms:
- An exploit is something that can be used to take advantage of a vulnerability. section 11.1.2
- A threat is the real possibility that a vulnerability will be exploited by an attacker. section 11.1.2
- A mitigation technique is a measure implemented to protect against threats, such as DHCP Snooping against DHCP vulnerabilities. section 11.1.2
- Vulnerabilities may exist even without external network connectivity; physical access can still provide an attack path. section 11.1.2
Network protocol and IOS examples
DHCP contains vulnerabilities that can be exploited with tools, while DHCP Snooping provides mitigation. IOS upgrades also address discovered security vulnerabilities: administrators can inspect the running image with show version and select a newer boot image with boot system. section 11.1.2 section 8.3
SW1# show version Cisco IOS Software, C2960C Software (C2960c405- UNIVERSALK9-M), Version 15.0(2)SE5, RELEASE SOFTWARE (fc1) #1 Technical Support: http://www.cisco.com/techsupport Copyright (c) 1986-2013 by Cisco Systems, Inc. . . . #1 The current version is 15.0(2)SE5.
Inspect the running Cisco IOS version when assessing whether known security advisories may affect a device. section 8.3
