Vulnerability › Module 6 › Lesson 1
CVSS Named
Common Vulnerability Scoring System literacy — read scores on YOUR lab findings, not weaponize stranger CVEs.
Visual · t18_cvss_named
CVSS = standardized severity score for a vulnerability. Original Cyberlium.
Opening
A CVSS number helps you prioritize fixes — it is not permission to exploit a host you do not own.
CVSS (Common Vulnerability Scoring System) translates vulnerability characteristics into a numeric severity score defenders use for triage and reporting. CVSS v3.x Base score reflects intrinsic severity; Temporal and Environmental adjust for exploit availability and your asset context. Learn to read NVD CVSS vectors on findings from YOUR $LAB_ASSETS scans — never treat public CVE scores as authorization to run exploit PoCs against stranger networks, classmate VMs, or employer production. VA is measure and report on owned scope; exploitation belongs in separate pentest RoE you do not have in this topic.
1. What CVSS answers
Base score: how bad is the flaw in isolation (attack vector, complexity, privileges, impact).
Scores map to bands: None, Low, Medium, High, Critical — use for sort order, not panic theater.
Command guide
Try these commands — What CVSS answers
═══ LINUX / KALI (Penetration Testing & Service Audit) ═══
Port scan and service banner grabbing against authorized target
Command — copy this
nmap -sV -sC -Pn -T4 -p 21,22,80,443,445,3389 ${LAB_HOST:-127.0.0.1}Enumerate web directories and hidden endpoints
Command — copy this
gobuster dir -u http://${LAB_HOST:-127.0.0.1} -w /usr/share/wordlists/dirb/common.txt -q -t 20 2>/dev/null || head -5 /etc/hostsMetasploit framework module inspection (Safe lab syntax)
Command — copy this
msfconsole -q -x "use auxiliary/scanner/portscan/tcp; set RHOSTS 127.0.0.1; set PORTS 80,443; run; exit" 2>/dev/null || echo "Run in Kali msfconsole"
═══ WINDOWS (Audit Target) ═══ Enumerate open listening ports with process mappings
Command — copy this
netstat -ano | findstr /i "LISTENING"
Primary tools to practice this lesson: curl, python3. Reference sites: FIRST CVSS v3.1 (https://www.first.org/cvss/v3.1/specification-document); NVD CVSS calculator (https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Where you see it
NVD entries, Nessus/OpenVAS plugin output, scanner dashboards on YOUR lab reports.
Vector string (CVSS:3.1/AV:N/AC:L/.) encodes the metrics — literacy beats memorizing every metric.
3. Scope boundary
Practice reading CVSS on scan exports from $LAB_ASSETS per YOUR RoE only.
No 'testing critical CVE' on coffee-shop Wi-Fi hosts or Shodan strangers — score literacy, not exploitation.
4. What you ship: CVSS vocabulary
CVSS definition + Base vs Temporal vs Environmental one-liner + $LAB_ASSETS-only scope sentence.
5. What you record before the next lesson
CVSS named paragraph.
6. Wrong vs right: stranger nets vs YOUR lab assets
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Run Metasploit module for a Critical CVE against a neighbor's NAS 'because NVD said so.'
Right
Name CVSS purpose and bands. Next: Base/Temporal.
Mission: CVSS literacy sheet
1) Define CVSS in one sentence. 2) Name Base, Temporal, Environmental. 3) Write NEVER exploit stranger hosts from CVE score.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Base vs Environmental — which for exec summary?”
Knowledge Check
APPLY: CVSS Base score reflects:
Multiple choice
Knowledge Check
APPLY: True or False: Critical CVSS authorizes exploit PoCs on stranger hosts.
True or False
Knowledge Check
APPLY: CVSS vector strings appear on:
Multiple choice