Command injection arises when untrusted text is interpreted as operating-system command syntax rather than a literal argument or data value; the observed evidence concerns DOM-based cross-site scripting instead.

CSRF exploits automatic credential attachment on cross-site requests; it does not require the attacker to read the victim's authenticated response; the test record points specifically to DOM-based cross-site scripting, not this separate mechanism.

Reflected XSS returns unsafely embedded input in the immediate server response; the payload does not need to be permanently stored by the application; that behavior is distinct from the DOM-based cross-site scripting finding being classified.

Stored XSS persists attacker-controlled content server-side and delivers it to later viewers through unsafe rendering; the scenario identifies DOM-based cross-site scripting, which has a different triggering condition.

A logout operation that only clears client storage may leave a server-side session valid, permitting reuse of an earlier stolen bearer token; the observed evidence concerns predictable session token instead.

Cross-site scripting can expose session cookies when HttpOnly is absent; the attacker obtains the bearer token rather than learning the account password; that behavior is distinct from the predictable session token finding being classified.

Session fixation works when a preauthentication identifier is accepted as an authenticated session, allowing the person who already knows that identifier to reuse it; the scenario identifies predictable session token, which has a different triggering condition.

Incorrect HTTP caching directives or cache keys can mix authenticated responses across users when intermediaries ignore session-specific variation; that behavior is distinct from the server version header finding being classified.

Proxy metadata headers are only trustworthy when inserted or sanitized by an authenticated, trusted upstream hop; arbitrary clients may forge them; the scenario identifies server version header, which has a different triggering condition.

Name-based virtual hosting routes requests using HTTP host identity, which may differ from the socket's IP address or default site; the defining symptom in the prompt is associated with server version header instead.

Capture destinations can contain sensitive traffic; management authorization and storage controls protect copied packets from unauthorized readers; the measure addresses a different trust boundary from the LLMNR name-resolution poisoning finding.

Limiting capture access and encrypting payloads reduce exposure; promiscuous mode by itself does not defeat switch isolation; its security benefit applies principally to promiscuous-mode capture, not the defect described; the tested fault instead involves LLMNR name-resolution poisoning.

Layer-2 encryption reduces interception on the protected physical path while higher-layer TLS still protects data beyond those MACsec peers; the exposure here is LLMNR name-resolution poisoning, which calls for another protective mechanism.

DAI validates ARP claims against established IP-to-MAC bindings and blocks spoofed updates instead of relying on host cache expiration; the action is aimed at ARP cache poisoning; it leaves the central LLMNR name-resolution poisoning condition unresolved.

Process-based verification resists convincing synthesized audio without relying on human ability to recognize every manipulated recording; this is relevant to a separate synthetic-voice impersonation scenario, rather than the identified exposure; the tested fault instead involves smishing.

A second verifier and trusted callback process resist authority-based fraud even when the message convincingly imitates leadership; the tested weakness is smishing, not the whaling configuration addressed here.

Device controls block execution or access from unknown media while a reporting route avoids relying only on curiosity-resistant behavior; that safeguard does not directly close the smishing route highlighted by the test.

Approved help-desk channels confirm personnel and tool provenance before users allow remote sessions or install agents; the specific root cause belongs to smishing, beyond this control's intended scope.

Documented verification steps stop plausible stories from replacing evidence of a requester's authority; that change targets pretexting, while the confirmed weakness involves smishing.

Confidentiality protects information against unauthorized disclosure; a system can preserve availability and integrity while still failing to restrict who reads sensitive material; the defining symptom in the prompt is associated with incident stop condition instead.

Integrity concerns whether data remains accurate and protected against unauthorized modification; silent record changes undermine trust without necessarily reducing system uptime; the events given do not establish this behavior but do support incident stop condition.

Availability means authorized users can reach required services when needed; exhausted capacity can violate this property even without evidence of data theft or corruption; the reported conditions are characteristic of incident stop condition, not that path.

Risk incorporates likelihood, business exposure, and impact; technical severity alone does not determine the order of remediation for distinct operational contexts; those prerequisites differ from the incident stop condition behavior in the record.

The signed rules of engagement define permitted assets, methods, windows, contacts, and stop conditions; informal requests cannot safely supersede that documented authorization boundary; this would classify another type of evidence, whereas the actual finding shows incident stop condition.

Application-specific probes and correlated firewall logs help distinguish a silent UDP listener from network filtering without guessing from silence; the exposure here is ICMP echo discovery, which calls for another protective mechanism.

Filtering and traffic analysis detect atypical reconnaissance, but a missing response should not be reported as confirmed open access; this is relevant to a separate TCP Xmas scan scenario, rather than the identified exposure; the tested fault instead involves ICMP echo discovery.

A complete host inventory must cover IPv6, while security controls should not disable essential ICMPv6 functions needed for normal operation; the tested weakness is ICMP echo discovery, not the IPv6 neighbor discovery configuration addressed here.

Slowloris-style attacks tie up connection slots by slowly transmitting incomplete HTTP request headers, exploiting permissive timeout behavior; those prerequisites differ from the slow HTTP POST behavior in the record.

A SYN flood consumes connection-state resources before handshakes complete; spoofed or unresponsive source addresses can aggravate backlog exhaustion; this would classify another type of evidence, whereas the actual finding shows slow HTTP POST.

State exhaustion targets the intermediary's connection-tracking resources, not necessarily the backend server or its application request queue; the relevant mechanism in the observed workflow is slow HTTP POST instead.

DNS response spoofing impersonates a reply to an outstanding lookup; success depends on response matching and resolver defenses against forgeries; this would classify another type of evidence, whereas the actual finding shows DNS resolver poisoning.

Link-Local Multicast Name Resolution can resolve names on the local segment without ordinary DNS; spoofed responses can redirect clients to hostile listeners; the relevant mechanism in the observed workflow is DNS resolver poisoning instead.

ARP poisoning forges address-resolution associations on a local broadcast domain, potentially redirecting or intercepting traffic through an adversary-controlled interface; those effects are not the DNS resolver poisoning pattern evidenced by the assessment.

Threat modeling is a structured way to reason about assets, entry points, trust boundaries, and attack paths before or during implementation; the relevant mechanism in the observed workflow is integrity instead.

Confidentiality protects information against unauthorized disclosure; a system can preserve availability and integrity while still failing to restrict who reads sensitive material; those effects are not the integrity pattern evidenced by the assessment.

Chain of custody tracks who controlled evidence and when, while integrity hashes can demonstrate whether its contents changed between collection and analysis; the case demonstrates integrity rather than the alternate mechanism.

Signature-based boot validation and attestation make unauthorized boot-chain modifications more difficult to execute unnoticed; the measure addresses a different trust boundary from the kernel rootkit finding.

Approved distribution channels and signed-package review reduce installation of malicious programs masquerading as useful utilities; the required correction concerns kernel rootkit, so this is not the targeted control.

Browser and endpoint controls reduce hidden collection channels, while network egress monitoring can identify telemetry sent to unapproved destinations; its security benefit applies principally to spyware collection, not the defect described; the tested fault instead involves kernel rootkit.