TechKnowSurge
Cisco CCST Cybersecurity 1.2 ISC2 CC 1.1 CompTIA A+ Core 2 2.4 NIST NICE K0683
TechKnowSurge Catalog Videos Threats - Common Vulnerabilities
VideoSecurityFree

Threats - Common Vulnerabilities

Vulnerabilities are weaknesses within attack vectors that can be exploited to compromise an organization, spanning technology, misconfigurations, and process failures. This content covers common vulnerability types across software, hardware, virtualization, protocols, cryptography, mobile devices, and supply chains.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

A vulnerability is a weakness within an attack vector that an attacker can leverage to breach an organization's defenses. The relationship between attack surface, attack vectors, and vulnerabilities can be understood through a physical analogy: if a building represents the organization, the attack surface is its entire exterior, each door or window is an attack vector, and the vulnerabilities are the specific weaknesses of each entry point, such as a faulty lock, a misdirected security camera, or a guard with a predictable break schedule. These weaknesses generally fall into three categories: technology failures, misconfigurations, and process breakdowns. In practice, vulnerabilities appear across nearly every layer of an IT environment. Hardware becomes a liability when firmware goes unpatched or equipment reaches end-of-life status and no longer receives security updates, leaving known flaws permanently unresolved. Virtualization introduces risks like virtual machine escape, where a guest VM gains unintended access to the underlying host, as well as data remnant exposure when shared resources such as memory or disk space are reallocated between machines. At the protocol level, the evolution from HTTP to HTTPS and through successive versions of TLS illustrates how even security-focused standards can carry vulnerabilities that require ongoing revision, while poor cipher selection or improper cryptographic implementation creates its own class of exposure. Misconfigured devices represent one of the most frequently encountered vulnerabilities in real-world environments, and while the fault often appears to lie with individual users, it typically reflects a failure in organizational processes and training. Mobile devices introduce additional risk when users jailbreak hardware or sideload unapproved third-party applications, bypassing built-in security controls. Finally, every vendor, cloud provider, and managed service provider in an organization's supply chain represents an independent attack vector with its own associated vulnerabilities, making third-party risk management an essential part of any comprehensive security strategy.

What you'll learn

What's covered

Vulnerabilities Overview

Aligned to

Cisco CCST Cybersecurity
1.2 Explain common threats and vulnerabilities
ISC2 CC
1.1 Understand cybersecurity concepts
CompTIA A+ Core 2
2.4 Explain common social-engineering attacks, threats, and vulnerabilities
NIST NICE
K0683 Knowledge of cybersecurity vulnerabilities

Key terms

Vulnerability
A weakness in a system, application, or process that can be exploited by a threat actor.
Attack Surface
The total set of points in a system where an unauthorized user can attempt to enter or extract data.
Exploit
A piece of software or technique that takes advantage of a vulnerability to gain unauthorized access or cause harm.
Hypervisor
Software that creates and manages virtual machines by abstracting hardware resources.
Virtual Machine
VM
A software emulation of a physical computer that runs an operating system and applications.
Transport Layer Security
TLS
A cryptographic protocol that provides secure communication over a network, successor to SSL.
Misconfiguration
An incorrect or insecure system or service setting made by an administrator that can expose vulnerabilities affecting confidentiality, integrity, or availability.
Supply Chain Vulnerability
A weakness introduced through third-party vendors, suppliers, or service providers that an attacker can exploit to compromise an organization.
Virtual Machine Escape
An attack in which a process inside a virtual machine gains unauthorized access to the underlying host system or other virtual machines.
Jailbreaking
The process of bypassing a mobile device's built-in restrictions to gain elevated privileges, often exposing the device to unapproved and potentially malicious software.

Topics

Vulnerability Management Attack Vectors Supply Chain Security Misconfiguration Mobile Security Virtualization Security Cryptography

Transcript

If I was attacking an organization, after analyzing what my attack vectors are, my next step would be to look for vulnerabilities.

What a vulnerability is

At this point, when we're looking at the vulnerabilities, we've already taken a look at our attack surface: where can we enter into the organization at? If the organization was a building and we're trying to gain access to the building, it would be all of this surface area here of how we can get into the building. The vectors would be the individual entry points into the building. A vulnerability would be the weaknesses of those individual attack vectors. As an example, if I were trying to go through the front door, what are the weaknesses, what are the vulnerabilities that I could leverage to make it through the front door?

So here are some examples of vulnerabilities. Maybe the lock on the front door is faulty, and so I'm easily able to pick it or break it, or perhaps it doesn't even function at all. Or maybe there's a camera on the front door, but it's pointed in the wrong direction, so it's completely useless. Or perhaps there's a guard, that normally I wouldn't say this is a good entry point to break into, however I know that they take a break for half an hour at midnight every single day, and since I know that routine I'm able to leverage that to be able to get through the door during that time.

If I wanted to label these, I could label that faulty lock as a technology weakness. Or perhaps the camera being pointed in the wrong direction, I could label that as being a misconfiguration, that someone misconfigured it. As far as the guard taking a break at the same time every day, then I could label that as a process problem.

Software and hardware vulnerabilities

We commonly see vulnerabilities within software. Another common source for vulnerabilities is hardware vulnerabilities. We see that with things like firmware, and not updating firmware on these different appliances. Of course Ware also gets a little bit back to that software side of things. But what happens is that this hardware can also become out of date, it becomes end of life and becomes legacy equipment, outdated equipment that's no longer getting updates. So if they were to find a security issue on end of life appliances, then it doesn't get updated, and so therefore there's that security vulnerability that just lasts on that equipment.

Virtualization

There are also common vulnerabilities associated with virtualization. Virtualization is when you have many virtual machines that are virtually running on top of one physical machine, and we have in between what's called a hypervisor that's controlling all of that. Well, one of these common vulnerabilities is virtual machine escape, and that's when one of these virtual machines gains more access than they should to controlling the actual machine.

And we also have some problems when it comes to resource reuse. That is that there's some allocation that happens. Let's say one machine gets allocated some disk space or memory usage, and then that gets reallocated later on, because these are all shared resources. So it gets reallocated to another device. Well, this other device may then have access to some of the prior information that this other machine was storing there.

Protocol and cryptographic vulnerabilities

We also have some protocol vulnerabilities. When we first started creating things like HTTP, it was not secure. So then what we did is we created HTTPS, a secure version of that. We used SSL at the time; now it's called TLS, Transport Layer Security. So we use Transport Layer Security to make HTTP more secure. But we found vulnerabilities in that as well, and so we had to go through different versions, and now we're on TLS 1.3, and that is a more secure version than TLS 1.2, it has less vulnerabilities to it.

We also implement cryptography to be able to secure our data, to encrypt our data, to make sure that their data is secure. However, if we're choosing the wrong ciphers, or we've implemented the wrong, then it has vulnerabilities as well. So we can have cryptographic vulnerabilities.

Misconfiguration

One of the most common ones that I found is just misconfigured devices. I've had employees that don't necessarily know what they're doing, or they haven't been paying attention, or they haven't followed their processes, and so therefore they make misconfigurations on the equipment, opening up vulnerabilities on the equipment. When there is misconfiguration, a lot of times we like to point at the user and say they misconfigured it. However, a lot of times it's a process problem. We need to take a look at the process and find out why the process failed, and why there's a vulnerability in the process.

Mobile devices and supply chains

There's also vulnerabilities associated with mobile devices. So as an example of this, somebody might jailbreak their phone. They may find that their phone is very restrictive on what they can install and what they can configure, and so what they'll do is they'll bypass the regular restrictions using a jailbreaking method, and then be able to have more control over their phone. And then they do things like side loading, where they install third-party software that's not supposed to go on the phone, that's not approved for the phone, but they install that software. It gives them extra functionality, but the problem is it opens up a lot of vulnerabilities for that unapproved software.

We also utilize several supply chains. That's other vendors, suppliers, cloud providers, managed service providers. They supply us with different services and technologies. Well, each one of those is an attack vector, and therefore it has its own set of vulnerabilities to it.

So each attack vector into our organization can have its own set of vulnerabilities. We talked about some of the common vulnerabilities, but there are a lot more that are out there. So we just have to be mindful of those different attack vectors and what vulnerabilities each of those attack vectors have.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →