What is a rogue device?
A rogue device is any piece of hardware attached to a network without approval. It is a vulnerability because it sits inside the perimeter while escaping the controls the organization built for approved equipment: inventory, patching, authentication and monitoring. Some rogue devices are careless rather than malicious, but either way they create a path that no one is watching.
Common forms
The best-known example is a rogue access point: an employee plugs a consumer Wi-Fi router into a desk jack for better coverage, and suddenly anyone in range can bridge onto the wired network, around the corporate Wi-Fi authentication and the firewall. Others include a personal laptop or small switch plugged into a spare jack, a device acting as a rogue DHCP server handing out wrong settings, and deliberately planted hardware, such as a small single-board computer hidden behind a printer that calls out over a cellular link. Attackers and penetration testers both use these network implants.
How it differs from an evil twin
A rogue access point is an unauthorized access point connected to your own network. An evil twin is different: it is an attacker's access point that imitates your network name to lure users onto it, and it need not touch your wiring at all. As a vulnerability type, the concern with a rogue device is the unapproved connection into the network itself, not the impersonation of a network name.
How to defend against it
Controls work at the switch port and over the air. Network access control with 802.1X requires every device to authenticate before its port carries traffic, placing unknown devices on a quarantine segment. Port security limits the MAC addresses allowed on a port and shuts it when an unknown one appears, unused ports are disabled, and DHCP snooping blocks rogue DHCP servers. Wireless intrusion detection compares every access point it hears with the approved list and flags unknown ones, especially any also wired into the network. Discovery scans reconciled against the asset inventory catch devices that slipped past.
Rogue device on the CompTIA Security+ exam
Rogue devices are a vulnerability type under SY0-801 objective 2.4. The scenario clue is unknown hardware appearing on a switch port, or an unapproved access point plugged into the corporate network. The controls the exam rewards are network access control, port security and wireless detection. Keep it separate from an unmanaged system, which was authorized but forgotten, and from shadow IT, which usually means unapproved software or cloud services; when unapproved hardware is physically connected to the network, rogue device is the better answer.