Diving into the CVSS Base Score Metrics - An Exploratory Analysis Bridging Product Security...

Diving into the CVSS Base Score Metrics - An Exploratory Analysis Bridging Product Security...

Speakers: Kohei Taguchi (Panasonic Holdings Corporation), Takayuki Uchiyama (Panasonic Holdings Corporation), Yuichi Kikuchi (Panasonic Holdings Corporation)

Conference: VulnCon

YouTube: https://www.youtube.com/watch?v=FWFEjXXBdb8

Overview

This talk, presented by Kohei Taguchi, Takayuki Uchiyama, and Yuichi Kikuchi from Panasonic Holdings Corporation, delves into a critical challenge faced by product manufacturers: effectively prioritizing vulnerability responses for IoT devices. Titled "Diving into the CVSS Base Score Metrics - An Exploratory Analysis Bridging Product Security...", the presentation highlights the limitations of relying solely on the CVSS base score for decision-making, particularly concerning medium-rated vulnerabilities. Panasonic's research, conducted within the framework of their Project Astrea (an initiative launched in 2017 to combat IoT threats using threat intelligence), aims to develop a more nuanced approach by analyzing CVSS metrics in greater detail and integrating real-world attack data.

The core premise of the research is that while high-severity vulnerabilities typically receive immediate attention, medium-rated flaws are often deprioritized, despite their potential to serve as crucial entry points in complex attack chains. The speakers argue that a comprehensive vulnerability response strategy must consider not only the inherent technical characteristics of a vulnerability but also the specific development environment and user environment of the product. This talk presents a method to bridge this gap, offering a more informed perspective on which vulnerabilities truly pose the highest risk and warrant urgent patching, thereby helping manufacturers protect their products and customers more effectively from evolving cyber threats.

Background

▶ Watch: Introduction: Panasonic's vulnerability response challenge (0:00)

As a global product manufacturer, Panasonic continually faces the challenge of managing and responding to a high volume of vulnerability reports, originating from both internal security testing and external researchers. The decision of how and when to fix a vulnerability is complex, often requiring consideration of the product's lifecycle stage, its intended use, and the potential impact on customers. Historically, many responders, including those at Panasonic, have relied heavily on the CVSS (Common Vulnerability Scoring System) base score as a primary metric for prioritizing these responses. However, as the presenters articulate, the CVSS base score, in its traditional application, lacks the contextual information needed to make fully informed decisions for specific products and their diverse operational environments.

The central problem identified is that the CVSS base score does not inherently account for factors like the development environment or the user environment of each product. This oversight can lead to misprioritization, especially for vulnerabilities categorized as "medium" (CVSS base scores typically between 4.0 and 6.9). While high-severity vulnerabilities (7.0-10.0) are almost always addressed quickly, medium-rated flaws are frequently given lower priority. The Panasonic team argues that this approach is risky because even medium vulnerabilities can be instrumental in the early stages of an attack chain, ultimately leading to severe consequences.

To illustrate this point, the speakers introduce two real-world examples:

• CVE-2024-45842: A path validation bypass vulnerability (CVSS 5.3) in a multi-function printer. This flaw allows an attacker to access internal files, potentially containing authentication or configuration data, due to improper handling of HTTP PUT requests.
• CVE-2024-47005: An access control issue where configuration APIs, intended for administrators, are not properly restricted. An attacker with general user privileges could execute administrative APIs.

In both cases, these medium-rated vulnerabilities, if left unaddressed, could serve as initial footholds, enabling attackers to gather information, escalate privileges, or eventually take complete control of a device. This underscores the critical need for manufacturers to look beyond the numerical CVSS base score and understand the potential role of each vulnerability within a broader attack scenario, tailored to the specific context of their IoT products.

Key Findings

▶ Watch: Research method: IoT vulnerability data collection (4:30)

The Panasonic research yielded several significant findings, divided into two main analytical phases.

Phase 1: Analyzing Medium-Rated IoT Vulnerabilities (Kohei Taguchi's Presentation)

The initial phase focused on identifying common aspects of medium-rated vulnerabilities in IoT products that could lead to serious situations.

• Data Set and Methodology: The team collected 424 vulnerabilities published in 2023 and 2024, specifically those with a medium CVSS base score (v3.1) and affecting IoT devices. Information was obtained via the NVD REST API, utilizing CVSS base metrics and CWE (Common Weakness Enumeration) for analysis.
• Honeypot Integration: To ground their analysis in real-world observations, Panasonic leveraged data from their IoT honeypot, part of the Astrea project. These honeypots, deployed using Panasonic home appliances, captured real-time attack attempts from around the world.
• Top Metric Combinations: The analysis revealed that most frequently occurring medium-rated vulnerabilities were exploitable over a network connection. This was not surprising given the focus on IoT devices.
• Most Common Combination: This combination was characterized by an Attack Vector: Network, Attack Complexity: Low, Privileges Required: None, User Interaction: None, Scope: Unchanged, and Confidentiality: Low, Integrity: None, Availability: None. While the direct impact on confidentiality was low, and integrity/availability were unaffected, the high exploitability led to a medium CVSS score.
• Product Categories: OT devices accounted for 42% of these vulnerabilities, followed by routers.
• CWEs: Common weaknesses included Improper Control of Resources and Improper Access Control.
• Honeypot Observation: The honeypot detected attacks targeting vulnerabilities in this category, specifically CVE-2020-14181 (classified as CWE-200, Information Exposure). Attackers were attempting to verify the existence of specific users on devices.
• Implication: These vulnerabilities are highly likely to be exploited in the initial phase of an attack chain (e.g., initial access), potentially leading to later stages like privilege escalation or complete device takeover if unpatched.
• Network-Exploitable with Availability Impact: Another significant combination involved vulnerabilities exploitable over the network that affected availability (Attack Vector: Network, Attack Complexity: Low, Privileges Required: None, User Interaction: None, Scope: Unchanged, Confidentiality: None, Integrity: None, Availability: High).
• Product Categories: Smart home devices were most common in this category.
• CWEs: CWE-787 (Out-of-Bounds Write) appeared most frequently, accounting for about half of these cases.
• Implication: These vulnerabilities pose a very high risk in environments like OT sites, where availability impacts (e.g., production line stoppages) can have severe operational consequences.
• Overall Conclusion (Phase 1): Even medium-rated vulnerabilities should not be assessed solely by their CVSS base score. It is crucial to consider the benefits an attacker can gain and their potential role as a starting point for chained attacks that can expand impact beyond the original scope (e.g., affecting integrity or availability, even if not initially indicated).

Phase 2: Comparing Public Data, Honeypot Data, and Internal Testing Results (Yuichi Kikuchi's Presentation)

The second phase broadened the analysis by comparing different data sources using CWE as a common language.

• IoT Honeypot Observations (2022-2024):
• Top CWEs: The most frequently observed attacks targeted injection-type vulnerabilities (e.g., OS Command Injection, SQL Injection) and vulnerabilities that do not require authentication (e.g., CWE-22, Path Traversal, manipulation of critical functions).
• Attacker Focus: Attackers primarily target vulnerabilities that allow them to obtain information or take over device privileges without requiring authentication.
• CWE Pillar Analysis: Many observed weaknesses fell under CWE-707 (Improper Neutralization), indicating a focus on input processing issues. In contrast, authentication-related weaknesses (CWE-284) were not particularly high (around 12%). This suggests attackers prefer exploiting input processing flaws over directly bypassing authentication mechanisms.
• Panasonic Internal Security Testing Results (2022-2024, pre-shipment):
• Scale: Approximately 2,000 issues were discovered across 80 types of CWIDs in IoT device testing.
• Top CWEs: CWE-200 (Information Exposure) was the most common, indicating issues where information is unintentionally exposed (logs, responses, configuration). CWE-1395 (Dependency on Vulnerable Third-Party Components) also ranked high, reflecting the reliance on external software.
• Nature of Weaknesses: Testing revealed many weaknesses stemming from design and configuration issues (information management, initial settings, dependency management), not just implementation bugs.
• CWE 1000 Structure: Analysis mapped to the CWE 1000 structure showed a large proportion of CWE-64 (Improper Control of a Resource Through Its Lifetime). This suggests that in IoT product testing, weaknesses in the design layer (authentication, communication, information management) are primary risks, potentially more so than input processing issues, especially for devices that don't accept direct user input.
• Comparison and Synthesis (Honeypot vs. Testing):
• Differences in Perspective: Security testing often focuses on identifying weaknesses that serve as the starting point or root cause of vulnerabilities (e.g., design flaws, configuration issues like CWE-1188, Improperly Configured Security with Improperly Configured Security and CWE-319, Cleartext Transmission of Sensitive Information). Attackers, as observed by honeypots, tend to target vulnerabilities at the endpoint or technical impact that directly lead to intrusion or code execution (e.g., CWE-78, OS Command Injection and CWE-22, Path Traversal).
• Complementary Views: Honeypots reveal what attackers do (dynamic attack techniques), while security testing provides data on how fast those attackers can succeed and what happens due to underlying weaknesses.
• Holistic View: It is crucial to view vulnerabilities not as isolated points but as a "line" representing attack scenarios. Understanding where each security issue fits into an attack chain and its role is vital for effective prioritization.

In summary, the key findings emphasize that a multi-faceted approach, integrating public vulnerability data, real-world attack intelligence, and internal product security testing results, is essential for truly understanding and prioritizing the risks posed by IoT product vulnerabilities, especially those that might be deceptively categorized as "medium" by conventional scoring systems.

Technical Deep Dive

▶ Watch: Prioritizing fixes based on product usage environment (13:00)

The research methodology employed by Panasonic was rigorously structured, leveraging established security frameworks and real-world data collection. The core of the analysis rested on CVSS version 3.1 base metrics and CWE (Common Weakness Enumeration), used as foundational tools to classify and understand vulnerabilities.

CVSS v3.1 Base Metrics:

The study specifically focused on the base metric group of CVSS v3.1, which describes the inherent characteristics of a vulnerability that are constant over time and across different user environments. These metrics include:

• Attack Vector (AV): How the vulnerability is exploited (e.g., Network, Adjacent, Local, Physical). The study found that most top-ranked medium vulnerabilities in IoT were exploitable over the Network (AV:N).
• Attack Complexity (AC): The conditions beyond the attacker's control that must exist to exploit the vulnerability (e.g., Low, High). Many high-risk medium vulnerabilities had Low Attack Complexity (AC:L).
• Privileges Required (PR): The level of privileges an attacker must possess before exploitation (e.g., None, Low, High). A significant number required None (PR:N).
• User Interaction (UI): Whether a user must do something for the exploitation to succeed (e.g., None, Required). Many critical medium vulnerabilities required None (UI:N).
• Scope (S): Whether the vulnerability can affect resources beyond the security scope of the vulnerable component (e.g., Unchanged, Changed). Many were Unchanged (S:U).
• Confidentiality (C), Integrity (I), Availability (A): The impact on these fundamental security properties (e.g., None, Low, High). The critical insight was that even if C, I, or A were individually rated "Low" or "None," the combination of high exploitability could still lead to a medium base score, masking a severe real-world risk. For instance, a common combination found was C:L, I:N, A:N, which, when combined with high exploitability metrics, still resulted in a medium score. Another critical combination focused on A:H, highlighting availability concerns in OT environments.

CWE (Common Weakness Enumeration):

CWE served as a "common language" for classifying and comparing different types of weaknesses. The study extensively used various CWE IDs:

• CWE-200 (Information Exposure): Identified in both public data analysis (CVE-2020-14181) and internal security testing as a top finding. This involves unintended disclosure of sensitive information.
• CWE-787 (Out-of-Bounds Write): Predominant in medium-rated vulnerabilities impacting availability, often leading to crashes or denial of service.
• CWE-78 (OS Command Injection) and CWE-22 (Path Traversal): Frequently observed in honeypot attack data, indicating attackers' preference for direct execution and filesystem manipulation.
• CWE-1395 (Dependency on Vulnerable Third-Party Components): A significant finding in internal security testing, emphasizing supply chain risks.
• CWE-64 (Improper Control of a Resource Through Its Lifetime): Highly prevalent in internal testing when mapped to the CWE 1000 structure, pointing to design-level flaws.
• CWE-707 (Improper Neutralization): A common pillar category for honeypot observed attacks, indicating issues with input validation.
• CWE-284 (Improper Access Control): While relevant, it was less prevalent in honeypot data compared to input processing issues.
• CWE-1188 (Improperly Configured Security with Improperly Configured Security) and CWE-319 (Cleartext Transmission of Sensitive Information): Identified in security testing as configuration weaknesses that provide entry points.

Research Methodology and Data Sources:

1. Public Vulnerability Data Analysis:

• Data Set: 424 vulnerabilities published in 2023 and 2024.
• Criteria: CVSS v3.1 base score classified as "medium" (4.0-6.9) and affecting an IoT device.
• Information Retrieval: Utilized the NVD REST API to gather CVSS and CWE data.
• Focus: Identified common metric combinations and associated product categories (e.g., OT devices, routers, smart home devices) and CWEs. Specific CVEs like CVE-2024-45842 (HTTP PUT bypass) and CVE-2024-47005 (admin API access) were highlighted.

1. IoT Honeypot Data Analysis:

• Source: Panasonic's own IoT honeypot system, part of the Astrea project, using Panasonic home appliances.
• Period: Two years (2022-2024).
• Purpose: To observe real-world attack trends and validate whether specific vulnerability types were actively being exploited. CVE-2020-14181 (CWE-200) was an example of an actively exploited vulnerability detected by the honeypot.
• Analysis: Clustered observed CWEs to understand attacker priorities (e.g., injection, unauthenticated access).

1. Internal Product Security Testing Results:

• Source: Panasonic Product Center's pre-shipment security testing.
• Period: Three years (2022-2024).
• Scale: Approximately 2,000 discovered issues, categorized by 80 CWIDs.
• Purpose: To understand weaknesses identified during the development phase of Panasonic's own IoT products.
• Analysis: Ranked CWEs, mapped issues to the CWE 1000 structure to identify higher-level design weaknesses.

By comparing these three distinct data sources, the researchers were able to draw a more complete picture of the vulnerability landscape. They identified that public data often highlights symptoms, honeypot data shows attacker behavior and endpoints, and internal testing uncovers root causes and design flaws. This multi-axis approach is crucial for a robust product security strategy.

Demo / Proof of Concept

▶ Watch: Comparing honeypot data with security testing results (15:30)

While the talk did not feature a live demonstration or proof-of-concept of an exploit, the research leveraged real-world attack data observed through Panasonic's IoT honeypot. This honeypot system, comprising Panasonic home appliances deployed to observe attacks globally in real-time as part of Project Astrea, effectively served as evidence of active exploitation attempts against the types of vulnerabilities discussed. For instance, the detection of attacks targeting CVE-2020-14181 (CWE-200, information exposure) by the honeypot directly validates that attackers are indeed attempting to exploit such medium-rated vulnerabilities in the initial phases of an attack chain. This real-world telemetry provided crucial empirical support for the study's conclusions regarding attacker motivations and the potential for seemingly low-impact vulnerabilities to serve as critical entry points.

Defensive Implications

▶ Watch: Conclusion: connecting issues across product lifecycle (26:00)

The findings from Panasonic's exploratory analysis carry significant defensive implications for both manufacturers and users of IoT products. The core message is a call to move beyond a simplistic reliance on CVSS base scores and adopt a more contextual, scenario-based approach to vulnerability management.

For Manufacturers (Developers and Product Teams):

1. Contextual Prioritization: Manufacturers must develop sophisticated prioritization models that go beyond the raw CVSS base score. This includes considering the specific usage environment of the product (e.g., consumer smart home vs. industrial OT), the benefits an attacker can gain, and the potential for a vulnerability to serve as an initial access point in a multi-stage attack.
2. Address Medium Vulnerabilities Proactively: The research strongly suggests that medium-rated vulnerabilities should not be deprioritized. Those with high exploitability (Attack Vector: Network, Attack Complexity: Low, Privileges Required: None, User Interaction: None) that allow for information exposure (CWE-200) or improper access control should be patched as quickly as possible, as they are actively targeted by attackers for initial reconnaissance and access.
3. Environment-Specific Response:

• For consumer products (e.g., IP cameras, DVRs), prioritize vulnerabilities that could lead to device takeover, even if they start with a seemingly low-impact information leak.
• For industrial IoT (OT) products, vulnerabilities impacting availability (A:H), such as those involving out-of-bounds writes (CWE-787), must receive the highest priority due to the potential for production line stoppages and severe operational impacts.

1. Integrate Diverse Data Sources: Combine insights from public CVE data, real-world honeypot intelligence, and internal security testing results. This holistic view helps to understand both the root causes (from testing) and the actual attack execution (from honeypots).
2. Focus on Design and Configuration Weaknesses: Internal security testing highlighted that many weaknesses stem from design-layer issues (authentication, communication, information management) and configuration flaws (CWE-1188), not just implementation bugs. Addressing these early in the development lifecycle is crucial.
3. Supply Chain Security: The prevalence of CWE-1395 (Dependency on Vulnerable Third-Party Components) underscores the need for robust supply chain security practices, including inventorying components and tracking known vulnerabilities.
4. Strengthen Authentication: If a vulnerability requires general user privileges, strengthening authentication mechanisms (e.g., enforcing strong, unique passwords, preventing default credentials like "12345678") can significantly reduce the attack surface.
5. Think in Attack Scenarios: Encourage security personnel and developers to view vulnerabilities as a "line" within an attack scenario, rather than isolated "points." Understanding how different weaknesses can be chained together is key to effective countermeasure prioritization.

For Users (Consumers and Enterprise/OT Operators):

1. Don't Underestimate Medium Scores: Users should not solely rely on a vulnerability's CVSS base score. Understand the context of your IoT devices and potential impact. A "medium" score might still pose a critical risk in your specific operational environment.
2. Prompt Patching: Apply patches and firmware updates for IoT devices promptly, especially for vulnerabilities categorized as medium but exhibiting high exploitability characteristics (network-exploitable, no privileges, no user interaction). These are often the first targets in real-world attacks.
3. Strong Authentication: Implement strong, unique passwords for all IoT devices and user accounts. Avoid default or weak credentials, as attackers actively seek to exploit these to gain initial access, even if a vulnerability requires "general user privileges."
4. Network Segmentation: For critical IoT deployments, particularly in OT environments, implement network segmentation to limit the blast radius of a successful compromise, especially for vulnerabilities that impact availability.
5. Monitor for Information Exposure: Be aware that information exposure vulnerabilities (CWE-200) can provide attackers with crucial data for subsequent attacks. Implement logging and monitoring to detect unusual access patterns or data exfiltration.
6. Understand Device Lifecycle: Recognize that threat landscapes change throughout a product's lifecycle. A flexible and evolving security strategy is necessary, adapting as new vulnerabilities emerge and attack patterns shift.

Ultimately, the research advocates for a flexible and appropriate response to each vulnerability, considering both the developer's responsibility to produce secure products and the user's need to deploy and operate them safely. This requires continuous improvement in data analysis and testing methodologies across the entire product lifecycle.

Key Takeaways

• CVSS Base Scores are Insufficient: Relying solely on the CVSS base score for prioritizing IoT vulnerabilities is inadequate. Contextual factors like the product's usage environment, potential attacker benefits, and its role in an attack chain are crucial for effective risk assessment.
• Medium Vulnerabilities are Critical Entry Points: Even medium-rated vulnerabilities (CVSS 4.0-6.9) can be highly exploitable and serve as initial access points for sophisticated, multi-stage attacks, often leading to severe impacts not reflected in their original score.
• Real-world Attackers Target Initial Access: Honeypot data reveals that attackers prioritize vulnerabilities that grant unauthenticated access, expose information (CWE-200), or allow for command injection (CWE-78) or path traversal (CWE-22) to gain a foothold.
• Design and Supply Chain Weaknesses are Prevalent: Internal security testing highlights that many weaknesses stem from design flaws, configuration issues (CWE-1188), and dependencies on vulnerable third-party components (CWE-1395), rather than just implementation bugs.
• Holistic View of Vulnerabilities: Manufacturers and defenders must integrate public vulnerability data, real-world attack intelligence (honeypots), and internal security testing results to understand vulnerabilities as "attack scenarios" (a line), not isolated "points."
• Contextual Response is Paramount: Vulnerability response strategies must be flexible, considering specific product types (consumer vs. industrial), their operational environments, and the different perspectives of developers (root cause) and attackers (exploit endpoint) to prioritize countermeasures effectively.

About the Speaker(s)

The talk was delivered by Kohei Taguchi, Takayuki Uchiyama, and Yuichi Kikuchi, all affiliated with Panasonic Holdings Corporation.

Kohei Taguchi initiated the presentation, providing the background and the initial analysis focused on public vulnerability data and honeypot observations. He mentioned this was his first time presenting at such an event, indicating his emerging role in the security research community. His work is deeply embedded in Panasonic's Project Astrea, an initiative since 2017 dedicated to leveraging threat intelligence to combat IoT threats and protect Panasonic products and customers.

Yuichi Kikuchi took over for the latter part of the presentation, focusing on the comparative analysis between real-world attack data from the IoT honeypot and internal product security testing results. His contribution highlighted the importance of using CWE as a common language to bridge different data sources and perspectives within the product security lifecycle.

While Takayuki Uchiyama was listed as a speaker, the transcript primarily features Kohei Taguchi and Yuichi Kikuchi presenting the content. All three speakers are integral to Panasonic's efforts in product security, vulnerability response, and advancing methodologies for assessing and mitigating risks in IoT devices. Their work reflects a manufacturer's perspective on addressing complex security challenges in a rapidly evolving threat landscape.