A configuration precondition is a feature, mode, or setting that must be enabled before a vulnerability can be triggered. In other words, the flaw exists in the software, but exploitation only works when the product is deployed in a specific state, such as a particular gateway mode, protocol option, or access-control setting.
This matters because exposure is not always uniform across all installations. Attackers look for devices that meet the required preconditions, which helps them focus scanning and exploitation on the most promising targets. Defenders use the same idea to assess risk: they verify whether the relevant feature is enabled, check inherited or default settings, and compare the live configuration against vendor guidance. A system may appear safe at a glance while still being vulnerable because a hidden option, legacy mode, or administrative change satisfies the trigger condition.