Enter CVE ID:

Base Metrics

---

Attack Vector (AV) Network (0.85) Adjacent (0.62) Local (0.55) Physical (0.20) Attack Complexity (AC) Low (0.77) High (0.44) Privileges Required (PR) None (0.85) Low (0.62/0.68) High (0.27/0.50) User Interaction (UI) None (0.85) Required (0.62) Scope (S) Unchanged Changed Confidentiality Impact (C) High (0.56) Low (0.22) None (0.00) Integrity Impact (I) High (0.56) Low (0.22) None (0.00) Availability Impact (A) High (0.56) Low (0.22) None (0.00)

Temporal Metrics

---

Exploit Code Maturity (E) Not Defined (1.0) Unproven (0.91) Proof-of-Concept (0.94) Functional (0.97) High (1.0) Remediation Level (RL) Not Defined (1.0) Official Fix (0.95) Temporary Fix (0.96) Workaround (0.97) Unavailable (1.0) Report Confidence (RC) Not Defined (1.0) Unknown (0.92) Reasonable (0.96) Confirmed (1.0) Calculate CVSS

Risk Impact Factors- This section to be developed further with the idea being to generate FPs at first to discuss with the team- Further refinement to come

Internet Facing ❓ Estimated number of public endpoints. **What do we want this to mean? Not internet facing (-.30) 10+ public endpoints (+.20) 20+ public endpoints (+.35) 50+ public endpoints (+.50) Number of Exposed Devices ❓ Approximate count of exposed devices. That we know of... 0 devices (score -0.30) 1–10 devices (+0.10) 11–50 devices (+0.20) 51–100 devices (+0.35) 100+ devices (+0.50) Active Exploitation ❓ Is the vulnerability being actively exploited (e.g. in KEV). This is a separate factor from Exploit Code Maturity Yes (+.50) No (+0) Criticality- Check weights ❓ Business/system criticality impact. **How granular should we get with this? None (-.20) Low (+.15) Medium (+.30) High (+.50) Calculate Risk Score

Combined Dashboard

This modifies the CVSS Base Score with the Custom Risk Score to assign a recommended action.

Calculate Action

Export Results

Export to CSV