Vulnerability › Module 6 › Lesson 1
CVSS Named
Common Vulnerability Scoring System literacy — read scores on YOUR lab findings, not weaponize stranger CVEs.
Visual · t18_cvss_named
CVSS = standardized severity score for a vulnerability. Original Cyberlium.
Opening
A CVSS number helps you prioritize fixes — it is not permission to exploit a host you do not own.
CVSS (Common Vulnerability Scoring System) translates vulnerability characteristics into a numeric severity score defenders use for triage and reporting. CVSS v3.x Base score reflects intrinsic severity; Temporal and Environmental adjust for exploit availability and your asset context. Learn to read NVD CVSS vectors on findings from YOUR $LAB_ASSETS scans — never treat public CVE scores as authorization to run exploit PoCs against stranger networks, classmate VMs, or employer production. VA is measure and report on owned scope; exploitation belongs in separate pentest RoE you do not have in this topic.
1. What CVSS answers
Base score: how bad is the flaw in isolation (attack vector, complexity, privileges, impact).
Scores map to bands: None, Low, Medium, High, Critical — use for sort order, not panic theater.
Command guide
Try these commands — What CVSS answers
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
FIRST CVSS v3.1 — https://www.first.org/cvss/v3.1/specification-document NVD CVSS calculator — https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Built-in (PowerShell: Invoke-WebRequest) Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
curl -sS https://www.first.org/cvss/v3.1/specification-document | head -8
python3 -c "print('Base: intrinsic; Temporal: exploit maturity; Environmental: YOUR context')"Primary tools to practice this lesson: curl, python3. Reference sites: FIRST CVSS v3.1 (https://www.first.org/cvss/v3.1/specification-document); NVD CVSS calculator (https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Where you see it
NVD entries, Nessus/OpenVAS plugin output, scanner dashboards on YOUR lab reports.
Vector string (CVSS:3.1/AV:N/AC:L/.) encodes the metrics — literacy beats memorizing every metric.
3. Scope boundary
Practice reading CVSS on scan exports from $LAB_ASSETS per YOUR RoE only.
No 'testing critical CVE' on coffee-shop Wi-Fi hosts or Shodan strangers — score literacy, not exploitation.
4. What you ship: CVSS vocabulary
CVSS definition + Base vs Temporal vs Environmental one-liner + $LAB_ASSETS-only scope sentence.
5. What you record before the next lesson
CVSS named paragraph.
6. Wrong vs right: stranger nets vs YOUR lab assets
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run Metasploit module for a Critical CVE against a neighbor's NAS 'because NVD said so.'
Right
Name CVSS purpose and bands. Next: Base/Temporal.
Mission: CVSS literacy sheet
1) Define CVSS in one sentence. 2) Name Base, Temporal, Environmental. 3) Write NEVER exploit stranger hosts from CVE score.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Base vs Environmental — which for exec summary?”
Knowledge Check
APPLY: CVSS Base score reflects:
Multiple choice
Knowledge Check
APPLY: True or False: Critical CVSS authorizes exploit PoCs on stranger hosts.
True or False
Knowledge Check
APPLY: CVSS vector strings appear on:
Multiple choice