Exploit Maturity Can Lower Scores Until Attack Evidence or PoCs Emerge
The CVE (Common Vulnerabilities and Exposures) program, which is supported by the U.S. government, stands as a key reference point for cataloging vulnerabilities. However, industry experts emphasize that the CVSS (Common Vulnerability Scoring System) scores associated with these vulnerabilities should not be considered absolute, as these scores can vary significantly for identical vulnerabilities. This notion was further clarified by Douglas McKee, Director of Vulnerability Intelligence at Rapid7, who pointed out that the circulating CVSS score often oversimplifies a multifaceted assessment.
Under the recently updated CVSS version 4.0 scoring system, vendors are tasked with assigning a base score that captures the vulnerability’s highest potential severity. Yet, this score may undergo modifications based on various threat factors, particularly if there are verified indications of exploitation. McKee highlighted the complexity involved in interpreting CVSS scores, stating, "A vendor may publish a 9.3 Base score for an unauthenticated RCE, while a threat-enriched assessment of that same CVE may currently be 8.1 because nobody has demonstrated exploitation." The deduction of severity in absence of any known exploit not only illustrates the dynamic nature of threat assessments but also points to the shift in knowledge about the threat landscape, reflecting how CVSS 4.0 enables a standardized means of conveying these changes.
The Forum of Incident Response and Security Teams, known as FIRST, released the latest guidelines for the scoring standard in late 2023. Along with these guidelines, an implementation manual was provided to assist organizations in comprehensively representing vulnerabilities’ severity within their specific environments, beyond just relying on base scores.
An important aspect of the new CVSS system is the scoring modification based on exploit maturity. This involves evaluating whether a vulnerability is currently being exploited, if there is a publicly available proof-of-concept (PoC), or if reliable threat intelligence suggests a lack of active exploitation. Nick Leali, Co-Chair of the FIRST CVSS Special Interest Group, stated that when CVSS users conclude that no active threat exists targeting a specific vulnerability, the resulting score typically lowers, indicating a de-prioritization of the risk posed by that vulnerability. Leali explained, “No known exploit is a good thing, right? So the number goes down."
However, this scoring system does present potential complications. Security researcher Kevin Beaumont illuminated a significant concern: certain vendors, designated as CVE numbering authorities, have the ability to alter consumer-facing metrics. Leading companies such as Palo Alto Networks, Microsoft, and Cisco are among those that can adjust their reported scores. Beaumont articulated a conspicuous implication of this policy: "The new CVE scoring system basically lets vendors set exploit maturity for every vuln to unreported, as there’s almost always no exploits before patch." As a consequence, this scenario leads to the likelihood that vulnerabilities will seldom score above 8 for unauthenticated remote code executions.
Though there’s no strict threshold capping scores at 10, Beaumont’s analysis seemed to suggest that manipulating exploit maturity from an "Undefined" state to "Unreported" could transition vulnerabilities from critical to high severity, thereby downplaying the associated risk. He cast doubt on whether vendors actively update CVSS scores in light of emerging exploit demonstrations and whether vulnerability management teams within organizations routinely reassess CVE scores with each update.
These variations underscore the importance of decision-making regarding patching not solely relying on a single numerical value. Lou Eichenbaum, the federal CTO at ColorTokens, stressed the need for organizations to maintain both the base and threat-adjusted scores along with their vector strings, dismissing the practice of treating a solitary number as definitive.
Furthermore, as artificial intelligence introduces rapidly evolving threats that may not conform to established norms or documented behaviors, the limitations of even an array of numbers and labels come into question. Ed Jennings, CEO of Darktrace, noted the changing landscape: "CVSS became the language of the industry because the threat was largely static. We no longer live in a world of static threats."
Organizations, therefore, face the ongoing challenge of consistently reevaluating vulnerabilities as intelligence regarding exploitation evolves. Eichenbaum encapsulated this imperative by asserting that evaluating technical severity, real-world exposure, and adversary actions must be conducted in conjunction; an unexploited vulnerability should not be hastily dismissed as harmless.
In conclusion, while the CVE program remains a cornerstone for addressing vulnerabilities, the complexities of CVSS scoring necessitate a more nuanced understanding and a comprehensive approach to vulnerability management. In an era where threats are in constant flux, organizations must diligently adapt and refine their strategies for addressing potential vulnerabilities to fortify their defensive postures against emerging threats.