📖 What is Zero-day Vulnerability?
A zero-day vulnerability is a software flaw that is unknown to the vendor and for which no official patch or fix exists. Because the vendor has 'zero days' to address the issue, these vulnerabilities are highly prized by attackers for creating reliable, undetected entry points.
"On the exam, if a vulnerability has no patch and is unknown to the vendor, it is always a zero-day."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of Zero-day Vulnerability?
- ▸ The distinction between a zero-day vulnerability (the flaw) and a zero-day exploit (the code used to trigger it) is critical for reporting.
- ▸ The window of vulnerability represents the time from the flaw's discovery by an attacker until a patch is developed and deployed.
- ▸ Signature-based security tools often fail to detect zero-days, making behavioral analysis and anomaly detection essential for identifying these unknown threats.
- ▸ Compensating controls, such as network segmentation or disabling unnecessary services, are the primary defense when an official vendor patch is unavailable.
🎯 How does Zero-day Vulnerability appear on the PT0-002 Exam?
You may be asked to identify a vulnerability in a scenario where a system is compromised by an attack that bypasses all current antivirus signatures and the vendor has no known fix.
A scenario might describe a penetration tester discovering a flaw in a custom-built application that has never been documented or reported to the developer; you must categorize this as a zero-day vulnerability.
Expect questions about the most effective mitigation strategy when a zero-day is discovered, requiring you to choose compensating controls, such as a WAF or network isolation, over patching since no patch exists.
❓ Frequently Asked Questions
What is the difference between a zero-day and an unpatched vulnerability?
A zero-day is unknown to the vendor. An unpatched vulnerability is one where the vendor has already released a fix, but the system administrator has not yet applied it to the system.
Can a zero-day be detected by a standard IDS?
Standard signature-based IDS typically cannot detect zero-days because no signature exists yet. However, anomaly-based or heuristic-based IDS can detect them by spotting unusual patterns or behavioral deviations.