Security Concepts · Topic 6 of 8
CVSS Metrics and Scoring
Learn the CVSS terms attack vector, attack complexity, privileges required, user interaction, scope, and the temporal and environmental metric groups.
- 4 min
- CVSS scores severity from 0.0 to 10.0.
- Attack vector, attack complexity, privileges required and user interaction describe exploitability.
- A network attack vector scores higher than local or physical.
What it is
The Common Vulnerability Scoring System, or CVSS, gives a vulnerability a score from 0.0 to 10.0 that shows how severe it is.
The score helps teams decide what to fix first. A higher score means a more serious flaw.
This page follows CVSS version 3.x, where the base metrics describe the flaw itself. Temporal and environmental metrics then adjust the picture.
How it works
CVSS has three metric groups, and the base group holds the terms that the exam names most.
Base metrics: exploitability
These describe how easy the flaw is to attack.
| Metric | Question it answers | Typical values |
|---|---|---|
| Attack vector (AV) | How does the attacker reach the target? | Network, Adjacent, Local, Physical |
| Attack complexity (AC) | How hard is the attack, apart from the attacker? | Low, High |
| Privileges required (PR) | What access does the attacker need first? | None, Low, High |
| User interaction (UI) | Does a user have to do something? | None, Required |
Attack vector is the first one to know. A Network vector means the flaw can be attacked remotely, so it scores higher than Local, which needs access to the machine, or Physical, which needs hands on the device.
Attack complexity is Low when the attacker can repeat the attack at will. It is High when conditions outside the attacker control must line up first.
Privileges required is None when no login is needed. A flaw that needs no privileges scores higher than one that needs an administrator account.
User interaction is Required when a person must click a link or open a file. The need for a victim to act lowers the score.
Base metrics: scope and impact
Scope asks whether a successful attack affects only the vulnerable component or also reaches other components. It is Unchanged when the impact stays inside the same security authority. It is Changed when the attack breaks out and harms something else.
An example is escaping a virtual machine to reach the host. A changed scope raises the score.
The impact metrics rate the damage to confidentiality, integrity and availability. These are the same CIA goals, each rated None, Low or High.
Temporal metrics
Temporal metrics change over time as the situation around the flaw changes. They cover:
- Exploit code maturity, which shows whether a working exploit exists
- Remediation level, which shows whether an official fix, workaround or nothing is available
- Report confidence, which shows how sure people are that the flaw is real
A flaw with a public, reliable exploit and no fix scores higher than one with no known exploit and a patch ready.
Environmental metrics
Environmental metrics tailor the score to your own organisation. They let you reflect how important the affected asset is to you and which controls already reduce the risk.
The same flaw may deserve a high priority on an internet facing payment server and a low one on an isolated lab machine.
Reading a vector
A CVSS vector is a short string that lists the base metric values. A flaw reachable over the network, with low complexity, no privileges and no user action needs only the right network path to attack. With high impact ratings, such a flaw scores in the critical range.
What to remember for the exam
Seven facts cover most questions on this topic.
- CVSS scores severity from 0.0 to 10.0.
- Attack vector, attack complexity, privileges required and user interaction describe exploitability.
- A network attack vector scores higher than local or physical.
- Scope Changed means the attack affects components beyond the vulnerable one.
- Temporal metrics track exploit maturity, remediation level and report confidence.
- Environmental metrics tailor the score to your own organisation.
- Base metrics describe the flaw and do not change with time.
Easier to attack means a higher score. Network, low complexity, no privileges and no user interaction is the worst case.
Common mistakes
These four errors appear often.
Treating the base score as final. Temporal and environmental metrics can raise or lower the priority for your own network.
Reading user interaction backwards. If a user must act, the flaw is harder to use, so the score is lower.
Confusing scope with attack vector. Vector is how the attacker arrives. Scope is whether the impact spreads beyond the vulnerable component.
Assuming a high score always means fix first. Environmental factors may place a lower scored flaw on a more critical asset.
Score ranges are also given names such as low, medium, high and critical, which help when reporting to non technical staff.
Check yourself
Work through these three questions.
Which attack vector value is the easiest to attack and scores highest?
Network, because the flaw can be attacked remotely.
What does a Scope value of Changed mean?
A successful attack affects components beyond the vulnerable one, which raises the score.
Which metric group lets an organisation adjust a score for its own assets?
The environmental metrics. They tailor the score to the importance of the asset and the controls already in place.
Topic 6 of 8 in Security Concepts
Test yourself on Security Concepts
The full Cisco CCNA 200-201 CBROPS question bank has 754 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Cisco. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.