CVSS v4 – A Better Version of an Imperfect Solution

The talk looks at the Common Vulnerability Scoring System, the widely adopted standard for rating vulnerability severity, and at its fourth version. The speaker explains why the earlier release was seen as too coarse, since different flaws could end up with the same score, and how version 4 reorganizes its metrics into base, threat, environmental and supplemental groups. A worked example involving a router vulnerability compares the old and new vectors, showing how the new attack requirements metric and the split between vulnerable and subsequent system impact change the resulting number.

The middle of the talk focuses on the limits of the standard. Severity is not the same thing as risk, and relying only on the base score is a common mistake. Scores suffer from missing context, especially for open source libraries whose exposure depends on how they are used, and from worst-case assumptions that can inflate ratings. Bug reporters sometimes overstate scores for rewards, and fully manual scoring does not scale to large numbers of findings. Maintainer fatigue and neglect add further friction.

To close, the speaker suggests feeding threat and environmental inputs from threat intelligence and asset inventories through automation, and having CVE numbering authorities publish scores with their advisories rather than leaving them to downstream databases. The takeaway for practitioners is to treat CVSS as one severity input among many, to read the specification closely, and to keep the base score from standing in for a full risk decision.