Almost every security advisory states a CVSS score, often shortened to "CVSS 9.8" or "critical". The standard is published by FIRST (Forum of Incident Response and Security Teams). The current version, CVSS 4.0, was published on November 1, 2023. CVSS 3.1 is also still widespread in many databases and tools. The rating often comes from the body that assigns the CVE, frequently the vendor itself.
How is a CVSS score calculated?
CVSS 4.0 consists of four metric groups:
- Base: properties of the vulnerability that do not change over time or across environments. These include the attack vector (for example over the network), the complexity, required privileges, whether a person must take part, and the impact on confidentiality, integrity and availability.
- Threat: the current state of the threat, above all whether exploit code exists. It replaces the former "Temporal" group.
- Environmental: adjustment to your own environment, for example if a system is not reachable from the internet at all.
- Supplemental: additional information such as whether an attack can be automated. It does not change the score.
The label shows which groups were included: CVSS-B stands for the pure base score, CVSS-BT, CVSS-BE and CVSS-BTE for scores with threat and environmental information. All values are contained in the vector, a string such as CVSS:4.0/AV:N/AC:L/….
What do Low, Medium, High and Critical mean?
The specification optionally assigns a rating to the numbers: 0.0 none, 0.1 to 3.9 Low, 4.0 to 6.9 Medium, 7.0 to 8.9 High and 9.0 to 10.0 Critical.
In practice for SMEs and municipalities
The base score is a good starting point, but it is not an order for updates. FIRST explicitly states that CVSS-B measures severity, not risk, and should not be used alone to prioritize patches. In practice, you combine three questions: How severe is the vulnerability (CVSS)? Is it already being exploited (CISA KEV) or is that likely (EPSS)? Is the affected system reachable from the internet in your organization, or is it business-critical? A medium vulnerability in a firewall at the network edge can therefore be more urgent than a critical one on an isolated test device.
Risks and typical mistakes
- Only looking at 9 and 10: Attacks often chain several medium-severity vulnerabilities.
- Mixing versions: Scores under CVSS 3.1 and 4.0 are not directly comparable. Pay attention to the version in the vector.
- Adopting someone else's rating: Only your company knows its environment. Record why you deviate from the default rating.
How TOMORIS relates
GRID.scout classifies findings not only by CVSS but also by reachability, impact and context. GRID.patch plans remediation in coordinated maintenance windows. The basics are covered in the entry vulnerability management.