← Years 9–10 Digital Systems

Software vulnerabilities

A flaw or bug in a program's code or settings, such as a coding mistake or an insecure default, that an attacker could use to get access or cause damage.

Part of: 9-10 Digital Technologies Vic Curric - Digital Systems and Security — Module 39, VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 19, ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 55

Understanding Software vulnerabilities in Years 9–10 Digital Systems

What it does: A setting left on by default that lets anyone in is a configuration flaw an attacker could use. Joining raw user input straight into a query is a coding mistake that attackers can use to gain access to data. A vulnerability is a weakness an attacker could take advantage of. Slow performance is not the same thing. Missing checks in code are common coding mistakes. Attackers can use them to cause damage. Default settings that are easy to guess leave a system open until someone changes them. A flaw is a vulnerability even if nobody has found or used it yet. An attack is when someone uses it.

Common mistakes: This coding mistake means the password is never checked, so anyone can log in. It should be: if check_hash(user, pw):. A default password that is easy to guess is an insecure default setting. Attackers try these first. It should be a random password: make_random_pw().

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Software vulnerabilities to a class →

This module's key terms are also in a printable crossword (Modules 25–40) and word search (Modules 13–40).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
Which best describes a software vulnerability?
A flaw or bug in code or settings that an attacker could useAny program that runs slowly on a device
Matches
Thinking: "Only big programs have vulnerabilities, so my small app is safe."
↓
Any program can have vulnerabilities. Though more code usually means more places for bugs, even small apps have flaws.
Applying
Meanings
Term
software vulnerability
Meaning
A flaw or bug in a program's code or settings, such as a coding mistake or an insecure default, that an attacker could use to get access or cause damage.
Practice
const settings = {
Testing
Gaps
debug = # off on live sites
Check Answer
Spots
1def login(user, pw):
2 if True:

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Silverback Gorilla' badge — Savannah Master, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which best describes a software vulnerability?
A. Any program that runs slowly on a device
B. A flaw or bug in code or settings that an attacker could use ✓
A vulnerability is a weakness an attacker could take advantage of. Slow performance is not the same thing.
2. A programmer forgets to check how long a user's input is, and this lets an attacker crash the app. What is this?
A. A feature that makes the app more secure
B. A coding mistake that creates a vulnerability ✓
Missing checks in code are common coding mistakes. Attackers can use them to cause damage.
3. A router ships with the admin password set to 'admin' for every customer. What type of vulnerability is this?
A. An insecure default setting ✓
B. A hardware fault in the cables
Default settings that are easy to guess leave a system open until someone changes them.
4. True or false: a vulnerability only exists once an attacker has already used it.
A. False: it exists as soon as the flaw is there ✓
B. True: it only counts after an attack
A flaw is a vulnerability even if nobody has found or used it yet. An attack is when someone uses it.
5. Why do large programs with millions of lines of code tend to have more vulnerabilities?
A. More code gives more places for bugs to hide ✓
B. Big programs are always written by careless people
More lines of code means more chances for a mistake, and some mistakes become vulnerabilities.

Match the Pairs

password = "admin123" # default login → An insecure default setting: a well-known password left in place that attackers can easily guess
for i in range(11): items[i] = 0 → A coding mistake: the loop writes past the end of a 10-item list, which is a bug an attacker might exploit
A software vulnerability can be a flaw in a program's settings, not just its code → allow_guest_access = True # default
A coding mistake is a vulnerability when the program trusts input it never checked → query = "SELECT * FROM users WHERE name='" + name + "'"
Thinking: "Only big programs have vulnerabilities, so my small app is safe." → Any program can have vulnerabilities. Though more code usually means more places for bugs, even small apps have flaws.
Thinking: "A vulnerability is the attack itself, such as a hacker stealing data." → A vulnerability is the weakness (a bug or bad setting). The attack is what happens when someone uses it.

Key Term

software vulnerability
A flaw or bug in a program's code or settings, such as a coding mistake or an insecure default, that an attacker could use to get access or cause damage.

Fill in the Blanks

1. debug = False # off on live sites
Hint: Type the boolean value that switches debug mode off so an insecure default setting is not left on.
2. if len(name) <= 20: print(name)
Hint: Type the built-in function that counts characters, used to check input size and avoid a coding mistake.
3. bugs = lines * rate
Hint: Type the variable for how much code there is. More code multiplied by the bug rate means more bugs.
4. password = "admin" if password == "admin": print("Change the default!")
Hint: Type the variable name being checked to spot an insecure default password.
5. newpass = input("Set a new one: ")
Hint: Type the built-in function that asks the user to type a value, so the default password gets replaced.

Spot the Error

Question 1
A def login(user, pw):
B if True:
C return True
D return False
Line B — This coding mistake means the password is never checked, so anyone can log in. It should be: if check_hash(user, pw):
Question 2
A admin_pw = "admin"
B save("admin", admin_pw)
C print("Change password now")
Line A — A default password that is easy to guess is an insecure default setting. Attackers try these first. It should be a random password: make_random_pw()
Question 3
A cfg = load_defaults()
B cfg["debug"] = False
C cfg["guest_login"] = False
D cfg["remote_admin"] = True
Line D — Turning remote admin on by default is an insecure default setting that gives attackers a way in. It should be False unless it is needed.
Question 4
A age = input("Age: ")
B if not age.isdigit():
C pass
D print("Age saved")
Line C — The program should stop when the input is not a number. Using pass lets bad input through, which is a coding mistake attackers can use. It should be exit().
Question 5
A old_features = ["beta_api"]
B for f in old_features:
C enable(f)
Line C — Unused old code should be turned off or removed. The more code that is running, the more bugs it can hide. It should be disable(f).

Student with a class code? Join your class →