Skip to content
Solvex Space

Technical note

Reading a CVSS vector for the shape that gets exploited at scale

A base score is one number. The vector behind it says whether an issue is reachable over the network, needs no privilege and no user interaction — the combination that gets exploited at scale. The CVE lookup reads the vector.

· 1 min read · written from the shipped implementation

Why the score alone misleads

Two vulnerabilities can share a base score and differ completely in practice. One needs an authenticated user to click something; the other is reachable by anyone on the internet with no credentials and no interaction. The second is what worms and mass-exploitation campaigns are built from. The score does not separate them; the vector does.

AV:N   attack vector: network — reachable remotely
PR:N   privileges required: none
UI:N   user interaction: none
The three vector components the lookup reads first.

What the lookup does

The Vulnerability CVE Lookup searches public vulnerability data by product and version, ranks advisories by base score, and reads each vector to flag the network-reachable, no-privilege, no-interaction shape. That flag is a triage aid: it says which entries to read first, not which to ignore.

What it is explicit about not knowing

A CVE list is not a risk assessment. Exploitation status is not consulted, so a flagged entry may have no known exploit and an unflagged one may be under active attack. And an empty result means nothing matched the query — a mistyped product name, a version string the data does not carry — never that a product is clean. The tool's limitations say all three, because a lookup that let silence imply safety would be worse than no lookup.

References

Reading a CVSS vector for the shape that gets exploited at scale — Solvex Space