Exploits, Tools & Data Recovery · How Bugs Become Attacks · Lesson 2 of 5

CVEs & Severity Scores

Read a CVE ID, decode a CVSS score, and see why real attacks beat high scores.

How a flaw gets its name

You saw in Mobile Malware that a CVE ID is a public label for one flaw, like CVE-2021-30860. Every bulletin in this course is built on these labels, so it's worth knowing exactly what they do and don't tell you.

The format is always the same: CVE, a year, and a sequence number of four or more digits. The year is when the ID was reserved or the flaw was made public, not necessarily when the bug was found. A flaw found in December can easily carry the next year's number.

IDs come from CVE Numbering Authorities (CNAs). There are hundreds of them around the world: software companies like Apple, Google and Samsung that number flaws in their own products, chip makers like Qualcomm, open-source projects like the Linux kernel, security firms and national response teams. Each CNA covers a defined scope, so one flaw doesn't end up with two numbers. When a product has no CNA of its own, a CNA "of last resort" can assign the ID.

Each ID points to a CVE Record, a short public entry describing the flaw, the affected products and versions, and links to the vendor's advisory. The record for CVE-2021-30860, for example, lists Apple as the CNA and shows iOS versions before 14.8 as affected.

A CVE record is a name tag, not a verdict. It doesn't say whether anyone has attacked the flaw. It may not carry a severity score at all. Some records are scored by the CNA, some by databases such as the US National Vulnerability Database (NVD), and some never get a standard score.

Not every bug gets an ID, either. Android's published rules say a CVE may not be issued for issues it rates Low. And an ID is often reserved early, while details stay private until a patch ships, so you may see a number mentioned before its record is filled in.

Why care? A shared ID lets a phone maker, a company IT team and a journalist all point at the same flaw. When a headline names a CVE, you can look it up on cve.org and see which products it hits and which update fixes it.

Scores, risk and the KEV list

Once a flaw has a name, people want to know how bad it is. The most common yardstick is CVSS, the Common Vulnerability Scoring System, maintained by FIRST (the Forum of Incident Response and Security Teams). The current version, 4.0, came out in 2023.

A CVSS base score runs from 0 to 10. It's built from questions about the flaw itself. Can it be attacked over a network, or only with the device in hand? Does the attacker need to log in first? Does the victim have to do something? How much could be exposed, changed or broken? FIRST's scale then turns the number into words:

• Critical: 9.0 to 10.0
• High: 7.0 to 8.9
• Medium: 4.0 to 6.9
• Low: 0.1 to 3.9

Not every vendor uses CVSS. Android rates bugs on its own Critical, High, Moderate and Low scale, based on the harm an attacker could cause if they exploited the bug. Remote code execution in the operating system's kernel, for example, is Critical. Apple's notes usually skip ratings and describe the impact in a sentence.

Here's the key point. FIRST describes CVSS as measuring severity, how bad a flaw could be, and says base scores should be combined with information about threats and your own environment. That fuller picture is risk: how likely you are to be harmed, and how badly. A Critical bug in a feature nobody uses, with no known attacks, can matter less this week than a High bug criminals are already using.

That's why CISA, the US Cybersecurity and Infrastructure Security Agency, keeps the Known Exploited Vulnerabilities (KEV) catalog. A flaw is added only when it has a CVE ID, there's reliable evidence of real attacks, and there's a clear fix, such as a vendor update. Research demos and proof-of-concept code don't count. US federal agencies must fix listed flaws within set deadlines, and CISA urges every organization to use the list to set priorities.

The catalog regularly includes iPhone and Android flaws. For a phone owner, a listing means one thing: install the update that fixes it now.