Diving into the CVSS Base Score Metrics - An Exploratory Analysis Bridging Product Security...
summary
Dataset includes 424 medium-rated IoT CVEs (2023–24) and ~2,000 security-testing issues (2022–24), correlated with traffic from a Panasonic IoT honeypot (2022–24). Results show many medium CVSS items are Network / No Privilege / No UI and can seed attack chains; observed exploits included attempts against CVE-2020-14181. Security testing surfaces design/config weaknesses (CWE-200, CWE-1395), while honeypots show attackers favoring input/execution flaws (CWE-78, CWE-22), so prioritize medium network-exploitable issues based on product environment.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:31Purpose of study
- 5:27Research method
- 7:16CVSS base score analysis
- 9:50IoT device vulnerabilities
- 15:52Honeypot vs testing data
- 21:35Attacker vs developer views
- 24:28Limitations and future work
- 27:18Conclusion
related talks
35mBlack and Blue, or White and Gold? Minimizing Vulnerability Scoring...
58mWhy Can't We All Just Get Along? Bridging the Gap in Vulnerability Prioritization Standards
57mDistributing Product Vulnerability Information: The Cisco VEXperience
01h 16mCVSS SIG Past, Present & Future + CVSS v4.0 Beyond the Numbers
57mSeeing the Vulnerable Forest Through the Exploited Trees
51mWhen it Comes to Managing Risk, Context is King
56mCVE Is The Worst Vulnerability Framework (Except For All The Others)
21mOWASP IoT Top 10