3.3.1. CVSS Interpretation
💡 First Principle: CVSS scores measure how bad a vulnerability is in the worst-case scenario — the base score assumes every risk factor is maximized. Environmental and temporal modifiers bring the score back to reality for your specific context.
CVSS (Common Vulnerability Scoring System) v3.1 uses a 0–10 scale with three metric groups:
Base Score Metrics (the core score):
| Metric | Options | What It Measures |
|---|---|---|
| Attack Vector (AV) | Network / Adjacent / Local / Physical | How far away can an attacker be? Network = remotely exploitable (highest impact on score) |
| Attack Complexity (AC) | Low / High | Does exploitation require specific conditions beyond attacker control? Low = reliably exploitable |
| Privileges Required (PR) | None / Low / High | What access must the attacker already have? None = unauthenticated exploitation |
| User Interaction (UI) | None / Required | Does a victim need to take action? None = no victim cooperation needed |
| Scope (S) | Unchanged / Changed | Can the vuln affect systems beyond the vulnerable component? Changed = can jump to hypervisor, other VMs |
| Confidentiality Impact (C) | None / Low / High | Data disclosure severity |
| Integrity Impact (I) | None / Low / High | Data modification severity |
| Availability Impact (A) | None / Low / High | Service disruption severity |
A CVSS 9.8 critical score (like EternalBlue / MS17-010) has: AV:Network, AC:Low, PR:None, UI:None, S:Unchanged, C:High, I:High, A:High. Every parameter maximized — remotely exploitable, no credentials needed, no user interaction, full CIA impact.
Temporal Metrics (modify base score based on current exploitation status):
- Exploit Code Maturity — Is exploit code publicly available? Proof-of-concept vs. functional exploit vs. weaponized exploit
- Remediation Level — Is a patch available? Temporary fix? No fix?
- Report Confidence — How confirmed is the vulnerability? Unconfirmed vs. confirmed by vendor?
Environmental Metrics (your organization's context):
- Modified Base Metrics — Override base metrics for your environment (a vulnerable service behind a firewall can justify lowering Modified Attack Vector from Network to Adjacent — not to Local, which means console/shell access)
- Asset Criticality — How important is this system to your business?
EPSS (Exploit Prediction Scoring System) — A complementary metric to CVSS that predicts the probability a vulnerability will be exploited in the wild within 30 days (0–100% scale). A CVSS 9.8 vulnerability with EPSS 2% is theoretically severe but rarely exploited; a CVSS 7.2 with EPSS 65% is actively being weaponized. Use CVSS for severity, EPSS for exploitation likelihood, and the CISA KEV catalog for confirmed active exploitation.
⚠️ Exam Trap: The CVSS base score does NOT account for whether a public exploit exists or whether the vulnerability is being actively exploited in the wild. Those factors are captured in temporal metrics, which are often not reported alongside the base score. Always check for "known exploited" status (CISA KEV catalog) separately from the CVSS score.
Reflection Question: Two vulnerabilities are reported on the same server: Vuln A has CVSS 9.8 (Network/Low/None/None — RCE, but no public exploit available). Vuln B has CVSS 7.5 (Network/Low/None/None — denial of service, with a Metasploit module available). Which should be patched first, and why does the CVSS base score alone give you the wrong answer?
