CVSS

What is CVSS?

The Common Vulnerability Scoring System (CVSS) is an open standard maintained by FIRST that expresses the technical severity of a vulnerability in software, hardware or firmware as a score from 0.0 to 10.0, together with an encoded vector that shows how the score was reached. Most CVEs receive a CVSS score from the vendor, from CISA or from the National Vulnerability Database run by NIST. That makes CVSS the common language of vulnerability scanning, patch management and risk management.

In OT, CVSS helps you prioritise vulnerabilities in PLCs, HMIs and embedded devices, provided you interpret the score correctly. A CVSS score describes the vulnerability, not your plant: availability, process safety and the reachability of the system are factors you have to add yourself.

🧠 What exactly does CVSS measure?

CVSS measures severity, not risk. FIRST states this itself in the version 3.1 user guide: the score is designed to measure the severity of a vulnerability and should not be used on its own to assess risk. The score tells you how easy a flaw is to exploit and what the consequences are for confidentiality, integrity and availability. It says nothing about whether the product runs in your plant, whether it can be reached, or whether anyone is already exploiting it.

Every score comes with a qualitative rating, identical in versions 3.x and 4.0:

Version 3.0 was also adopted in 2016 as ITU-T Recommendation X.1521. Vendors, governments, scanners and SIEM products worldwide use the same scale, so a 9.8 means the same thing everywhere.

🕰️ How has CVSS evolved?

CVSS started as research by the US National Infrastructure Advisory Council (NIAC). FIRST, the international forum of incident response and security teams, then took over its stewardship.

The NVD has not assigned new v2 scores since July 2022. In practice you will mostly see v3.1 and, increasingly, v4.0: many vendors and CISA’s ICS advisories now publish both scores side by side.

🔢 How is a CVSS score built up?

A CVSS score is made up of metric groups. The Base group describes the fixed characteristics of the vulnerability; that is the score the vendor or the NVD publishes. The other groups are filled in by the user.

In version 4.0 the name tells you which groups were included: CVSS-B is Base only, CVSS-BT Base plus Threat, CVSS-BE Base plus Environmental and CVSS-BTE all three. Version 4.0 also no longer uses a formula. Around 15 million possible vectors have been grouped into 270 classes of comparable severity, the macrovectors, and the score is interpolated within such a class.

📊 How do you read a CVSS vector?

Take a vulnerability in the web interface of a PLC that lets an attacker execute code without logging in. In version 3.1 the vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

The result is 9.8 (Critical). In version 4.0 the same vulnerability is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N and scores 9.3. Only when the vendor also indicates high impact on subsequent systems, such as the machine being controlled, does it reach 10.0. A difference between v3.1 and v4.0 scores is therefore normal and does not mean that either one is wrong.

🏭 Why is CVSS hard to interpret in OT?

CVSS comes from the IT world, where confidentiality often comes first. In OT, availability and safety take priority. That leads to three well-known distortions:

• Availability carries too little weight - a denial of service from the adjacent network (AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) scores only 6.5 (Medium) in v3.1, while a single hung controller can stop an entire production line.
• Physical consequences are missing - CVSS v3.1 has no notion of process safety. Version 4.0 adds the supplemental metric Safety. In the Environmental group you can also set the impact on subsequent systems to Safety, which raises the score.
• Reachability is overestimated - a flaw rated AV:N on a PLC that can only be reached through a well-protected zone deserves a different local assessment.

CVSS therefore does not replace the IEC 62443-3-2 risk assessment or the hazard analysis from functional safety that determines the required SIL. It does provide the technical input for both.

🔧 How do you use CVSS to prioritise OT vulnerabilities?

A workable approach combines the Base score with context:

1. Match advisories to your assets - compare CVEs from vendor advisories and CSAF documents with your asset inventory and, where available, an SBOM.
2. Check for active exploitation - if the CVE is listed in CISA’s KEV catalogue, it goes first, regardless of the score.
3. Use EPSS for the long tail - the probability of exploitation in the next 30 days, also published by FIRST, helps you sort thousands of medium scores.
4. Calculate an Environmental score - set the availability requirement (AR) to high for production-critical systems, adjust the Attack Vector to the real reachability and, in v4.0, use the Safety value.
5. Choose an action - patch during a maintenance shutdown, apply a compensating control or accept the risk deliberately. Record the decision in the risk register.

An example of an internal policy rule, based on the official rating boundaries:

Involve engineering and maintenance in the assessment: they know which function a device performs in the process and when a shutdown is possible. For a broader decision tree you can use SSVC, developed by the Software Engineering Institute at Carnegie Mellon together with CISA. It translates exploitation, impact and public well-being into actions such as Track, Attend or Act (see vulnerability management).

🔐 What role does CVSS play in the Netherlands and the EU?

• NCSC - the Dutch NCSC uses its own rating of likelihood and damage (each low, medium or high) in its security advisories, and lists the CVSS scores of the underlying CVEs alongside it.
• ENISA - the European Vulnerability Database (EUVD), set up under Article 12 of NIS2, shows vulnerabilities with CVSS scores and EUVD identifiers linked to CVEs.
• Cyber Resilience Act - under the Cyber Resilience Act, manufacturers must report actively exploited vulnerabilities from 11 September 2026. A CVSS score helps to substantiate the severity, but the reporting obligation depends on exploitation, not on the score.
• IEC 62443 - IEC 62443-4-1 requires suppliers to assess and handle reported security issues; in practice, CVSS is the usual yardstick for expressing that severity. Within IEC 62443, CVSS also feeds the risk analysis per zone.

🧮 How do you calculate a CVSS score yourself?

Choose the eight base metrics. The calculator computes the CVSS 3.1 base score and the vector string according to the FIRST specification.

❓ Frequently asked questions

What is a good CVSS score?

A low CVSS score means a vulnerability is technically less severe: 0.1–3.9 is Low and 9.0–10.0 is Critical. Strictly speaking there is no “good” score, because even a vulnerability with a low CVSS score can have serious consequences in an OT environment. Always assess the score together with the role of the system in your process.

Who determines the CVSS score of a vulnerability?

The Base score of a CVSS vector is usually set by the vendor or the CVE Numbering Authority that publishes the vulnerability. The NIST NVD and CISA often add their own score, which may differ from the vendor’s. The Threat and Environmental scores are filled in by the user.

What is the difference between CVSS v3.1 and CVSS v4.0?

CVSS v4.0, published on 1 November 2023, replaces the Temporal group with a Threat group containing only Exploit Maturity and separates the impact on the vulnerable system from the impact on subsequent systems. Version 4.0 also adds supplemental metrics such as Safety and Automatable. As a result, the same vulnerability can score differently in v4.0 than in v3.1, for example 9.3 instead of 9.8.

Is CVSS the same as risk?

No, CVSS measures the technical severity of a vulnerability, not risk, and FIRST says so in its own documentation. Risk only emerges when you combine the CVSS score with the likelihood of exploitation, the reachability of the system and the consequences for your organisation. That is why organisations use CVSS together with KEV, EPSS and their own risk analysis.

What is the Environmental score in CVSS?

The Environmental score adapts the CVSS score to your own environment, for example by specifying a high availability requirement or entering the real network reachability. In CVSS v4.0 you can also set the impact on subsequent systems to Safety when exploitation could cause physical harm. For OT, the Environmental score is the most important way to make a generic score useful.

Why do OT vulnerabilities sometimes get a CVSS score that is too low?

CVSS weighs confidentiality, integrity and availability equally and had no notion of physical safety until version 4.0. A denial of service on a PLC therefore often scores Medium, while downtime of a plant can have major consequences in OT. The Environmental metrics and the Safety values of CVSS v4.0 let you correct for that.

📌 In summary

CVSS is the worldwide standard for capturing the technical severity of vulnerabilities in a score from 0.0 to 10.0, with version 3.1 the most widely used and version 4.0 its successor with a Safety metric. In OT the Base score is a starting point: combine it with KEV, EPSS, your asset inventory and an Environmental score that gives availability and safety the weight they deserve.

CVSS helps you compare vulnerabilities objectively, but it measures severity, not risk; in OT, always enrich the score with knowledge of the installation, the process and the consequences for people and safety.