CompTIA Security+ SY0-701 · Free study guide

Objective 2.3 — Identify and compare vulnerability classes

A vulnerability is a weakness that can be exploited; it is not the same as an attack, threat actor, or confirmed compromise. Classify the weakness by where it occurs and how it can fail so the team can assign the right owner and remediation.

Application weaknesses include unsafe memory handling, buffer overflows, memory injection, and race conditions. In a time-of-check/time-of-use race, a program validates a resource and later uses it after its state has changed. Web applications face input-driven problems such as SQL injection and cross-site scripting. Parameterized queries address SQL injection; context-aware output encoding and safe DOM handling address XSS. Generic “sanitize everything” advice is too vague.

Platform and infrastructure weaknesses

Operating-system weaknesses can arise from defects, insecure permissions, missing patches, or unsupported versions. Hardware and firmware weaknesses may persist below the OS and can be difficult to update. End-of-life and legacy systems are not identical: a legacy system is old but still used; end-of-life means the supplier no longer provides normal support. Both demand explicit risk treatment.

Virtualization risks include escape from a guest into the host and unsafe resource reuse that exposes remnants to a new tenant. Cloud-specific weaknesses often involve identity, public exposure, storage permissions, secrets, or misunderstood shared responsibilities. Misconfiguration can make secure technology unsafe without any software defect.

Mobile sideloading bypasses approved distribution channels. Jailbreaking or rooting removes platform restrictions and weakens management assumptions. Supply-chain vulnerabilities can enter through a service provider, hardware component, library, build system, or update process. A malicious update is particularly dangerous because it abuses trusted delivery.

Cryptographic vulnerabilities include obsolete algorithms, poor randomness, reused nonces, exposed keys, weak key lengths, and unsafe protocol configurations. Replacing one cipher name is not enough if keys remain compromised or certificates are not validated.

A zero-day is a vulnerability for which defenders do not yet have a broadly available fix or adequate prior warning. It does not guarantee exploitation. Segmentation, least privilege, allow listing, behavior monitoring, and isolation can reduce exposure while a patch is unavailable.

Decision rule: identify the vulnerable layer and failure mechanism, then select a remediation that addresses the weakness rather than only blocking one observed exploit string.