Common Vulnerability Scoring System (CVSS)

The Common Vulnerability Scoring System (CVSS) is a vendor-neutral, open standard maintained by the Forum of Incident Response and Security Teams (FIRST). It provides a structured method for assessing the severity of software vulnerabilities on a 0–10 scale: None (0), Low (0.1–3.9), Medium (4.0–6.9), High (7.0–8.9), and Critical (9.0–10.0). CVSS v3.1 and v4.0 are the current versions in active use. A CVSS score consists of a Base Score (intrinsic characteristics), a Temporal Score (exploit maturity and remediation), and an Environmental Score (deployment context). The Base Score is most widely cited; the Temporal and Environmental scores allow downstream organisations to adjust for their specific circumstances.

The CRA does not mandate CVSS by name, but Annex I Part II and Article 14 require manufacturers to handle vulnerabilities without undue delay and to prioritise remediation based on risk. CVSS is the universally accepted mechanism for expressing that risk quantitatively. When manufacturers publish security advisories — required when releasing patches — regulators and downstream customers expect CVSS scores to be present. The CSAF standard (ISO/IEC 29147 and OASIS CSAF 2.0), which ENISA recommends for CRA-compliant advisories, includes CVSS as a mandatory field for each vulnerability record. Without CVSS scoring, a manufacturer cannot demonstrate risk-based prioritisation to auditors or market surveillance authorities.

Accurate CVSS scoring requires understanding the attack vector, complexity, and impact:

• Attack Vector (AV) — Network, Adjacent, Local, or Physical. A remotely exploitable flaw scores higher.
• Attack Complexity (AC) — Low or High. Exploits that require no special conditions score higher.
• Privileges Required (PR) and User Interaction (UI) — unauthenticated, zero-click vulnerabilities score highest.
• Impact (C/I/A) — Confidentiality, Integrity, Availability impact on the vulnerable system.

Common scoring errors: overestimating Scope (Changed vs. Unchanged), assigning Low AC when special configuration is actually required, and ignoring the Temporal metrics when a public PoC is available.

Manufacturers new to CVSS frequently encounter these problems:

• Scoring from the researcher's PoC rather than the deployed product — the correct base score reflects the worst-case deployed scenario, not a lab environment.
• Using CVSS 2.0 — CVSS v2 is retired; CVSS v3.1 or v4.0 is required for credible advisories.
• Publishing only the score without the vector string — regulators and downstream users cannot verify or adjust a bare numeric score.
• Treating CVSS as a prioritisation absolute — a CVSS 9.8 in a product deployed in an air-gapped factory may be lower operational priority than a CVSS 7.0 in an internet-facing device. Environmental scores address this.