A network engineer reviews switch configurations after a penetration test report indicates an attacker on an access port was able to inject frames that reached devices on a different VLAN without crossing a router. The report notes the attacker crafted frames containing two stacked 802.1Q tags. Which switch configuration weakness most directly enabled this attack, and what should be corrected?