A company hired a third-party firm to conduct as assessment of vulnerabilities exposed to the Internet. The firm informs the company that an exploit exists for an FTP server that has a version…

Default configuration refers to issues arising from insecure out-of-the-box settings, but the primary problem described is the software's age and lack of vendor support, not necessarily its initial setup.

The software is eight years old and no upgrade exists from the vendor, which explicitly indicates it has reached its end-of-life (EOL) or end-of-support status. When software is EOL, the vendor ceases to provide crucial security patches and updates, making any discovered vulnerabilities unpatchable and leaving the system exposed to exploits.

A weak cipher suite relates to cryptographic protocols used for secure communication; while an old FTP server might use weak ciphers, the core issue is the general existence of an exploit due to unpatchable, outdated software, not specifically a cryptographic flaw.

Zero-day threats are vulnerabilities unknown to the vendor or public for which no patch exists yet, whereas this scenario describes an exploit for eight-year-old software that can no longer be updated by the vendor, implying it's a known vulnerability left unpatched due to lack of support.