Vulnerability

A vulnerability is a security flaw caused by a mistake in the basic software of a computer or phone (its operating system), in an app or in the software inside a device. It is also called a security hole. Vulnerabilities are found not only in computers and phones but also in devices such as the boxes that connect a home or office to the internet (routers) and in home appliances. [1] [2]

When one is found, the maker usually releases a fixed version or patch. New vulnerabilities keep turning up after each fix, so updating is never done once and for all. [1]

The seriousness of a published vulnerability is rated with CVSS, a scoring method used worldwide, as a score from 0 to 10.0 and a band such as critical, high, medium or low. [3]

• A system with an unfixed vulnerability can be broken into or infected with malware. [1]
• A server open to the internet can have its website defaced, or be used by attackers as a stopover point to attack others while hiding where they really are. [1]
• Flaws in VPN devices, which let staff connect to the office computers from outside, and in similar devices are a main way in for ransomware attacks. [4]
• Software and devices whose maker no longer provides fixes (past their end of support) stay unfixed when new vulnerabilities are found. [2]

• Update to a fixed version. Any device left unpatched can let attackers back in the same way. [4]
• Change the passwords of accounts used through the device in case attackers used the flaw before the update; updating does not stop logins with IDs and passwords already stolen. [4] [6]
• Look for unknown accounts and odd login attempts, and check the systems behind the device for hidden ways back in left by attackers (backdoors) or malware. [6]

This site covers a vulnerability only after Japan's vulnerability notice site JVN, the worldwide CVE list or the maker has published it, with the product, versions, severity and fix. It never shows how to attack it or lists of exposed systems. A published vulnerability alone does not show that a named organization was broken into.

Incidents where a website or app was attacked through a flaw carry the method Web app exploit. Organizations that paused services after a disclosure to avoid harm are recorded as Precautionary halt.

How precautionary halts affect severity is explained under Severity and impact levels in the guide.