Cybersecurity
What Is a CVSS Score and How Do You Read It?
CVSS (Common Vulnerability Scoring System) is an open standard that rates the severity of a security flaw from 0 to 10. Here is how to read each score range.
SEO and Content Specialist
2 min read Reviewed by Legia Cybersecurity Team
Short answer: CVSS (Common Vulnerability Scoring System) is an open standard from FIRST for rating the severity of a security flaw on a scale of 0.0 to 10.0. A score of 9.0 or above is critical, 7.0 to 8.9 is high, 4.0 to 6.9 is medium, and 0.1 to 3.9 is low. In a test report, the score decides the order of fixes.
A CVSS score appears in almost every vulnerability assessment and penetration testing report. For management, the number is the fastest way to tell which findings must be fixed this week and which can be scheduled.
What each score range means
| Level | Score | How to respond |
|---|---|---|
| Critical | 9.0 to 10.0 | Usually exploitable from outside without an account, leading to a takeover of the system or its data. Handle immediately. |
| High | 7.0 to 8.9 | Exposes important data or functions, often under certain conditions such as an ordinary user account. Handle right after the critical ones. |
| Medium | 4.0 to 6.9 | Limited impact, or several conditions are needed at once. Schedule the fix. |
| Low | 0.1 to 3.9 | Hard to exploit on its own, but can help another attack. Include it in follow-up fixes. |
A score of 0.0 means no impact. The ranges are the same in CVSS version 3.1 and 4.0.
What makes up the score?
The base score is calculated from the characteristics of the flaw itself, including:
- attack path: from the internet, from the same network, or requiring physical access to the device;
- attack complexity and the privileges the attacker needs;
- whether user action is required, for example clicking a link;
- impact on the confidentiality, integrity, and availability of data or systems.
CVSS 4.0 adds a group of threat metrics (whether an exploit is already circulating) and environmental metrics (how important the system is to your organization). Names such as CVSS-B or CVSS-BTE show which metric groups were used.
Do not stop at the number
The base score rates a flaw in general, not in your company. A medium flaw on a server that holds customer data can be more urgent than a high flaw on an isolated test server. That is why a good report adds context: which assets are affected, the evidence for the finding, and the steps to fix it.
A practical way to use it in a remediation meeting: sort the findings by level, then within the same level put assets that hold personal data or are exposed to the internet first. Assign an owner and a deadline for every critical and high finding, and ask for a retest before calling it done.
At Legia, every finding is given a CVSS score and grouped into the four levels above. Critical and high findings are reported immediately, without waiting for the final report, and all findings are retested after they are fixed.
The difference between the two testing approaches is covered in Vulnerability Assessment or Penetration Testing, and the service details are on the Penetration Testing page.
Sources
Asked to hand over security test results for an audit or a release? See Legia cybersecurity services, or schedule a consultation through the contact page.
