Skip to content
eastbaycyber
Security Toolkit · FIRST.org CVSS v3.1

CVSS v3.1 Vector Calculator & Blast Radius Decoder

Decode, calculate, and analyze Common Vulnerability Scoring System (CVSS v3.1) vector strings. Inspect individual exploitability metrics, blast radius scope changes, and generate executive vulnerability triage narratives.

Interactive Triage: Click any vector metric below or paste a raw CVSS string. URL query parameter ?vector=... is supported for direct bookmarking and CVE linking.
Load sample CVE vectors:
Base Score:9.8/ 10.0
Critical
Exploitability Sub-Score: 3.9 / 3.9
Impact Sub-Score: 5.9 / 5.9
Scope Traversal: Scope Unchanged
1. Exploitability Metrics
Attack Vector (AV):
Attack Complexity (AC):
Privileges Required (PR):
User Interaction (UI):
2. Impact & Scope Metrics
Scope (S):
Confidentiality (C):
Integrity (I):
Availability (A):
Executive Triage & Blast Radius Summary:

Assessed at CVSS 9.8 (Critical). Exploitable remotely over the public internet without network proximity with low attack complexity, requiring zero credentials, and without victim interaction. Impact is contained strictly within the security authority of the vulnerable software component. Complete compromise: total loss of confidentiality, integrity, and availability.

How CVSS v3.1 Calculates Base Scores

The Common Vulnerability Scoring System (CVSS) is governed by FIRST.org. The base score evaluates a vulnerability assuming maximum adversary capability under default installation parameters. The calculation proceeds in three stages:

  1. Impact Sub-Score (ISS): Measures loss across confidentiality (C), integrity (I), and availability (A):
    ISS = 1 - [(1 - C) × (1 - I) × (1 - A)]
  2. Exploitability Factor: Measures the technical ease with which the vulnerability is accessed:
    Exploitability = 8.22 × AV × AC × PR × UI
  3. Scope Adjustment: When Scope is Unchanged (S:U), BaseScore is calculated directly as Roundup(min(Impact + Exploitability, 10)). When Scope is Changed (S:C), a 1.08× amplification factor applies.

Understanding Scope Changed (S:C)

A scope change indicates that exploiting the flaw enables the adversary to traverse a security authority boundary. Classic examples include:

  • Container breakouts: Exploiting a containerized service to execute code on the underlying Linux host kernel.
  • Hypervisor escapes: An attacker in a guest virtual machine executing commands on the bare-metal hypervisor.
  • Cross-Site Scripting (XSS): Injected script code runs with browser privileges in the victim’s origin sandbox rather than server process authority.

Severity vs. Real-World Risk

CVSS measures theoretical severity, not actual organizational risk. A CVSS 9.8 vulnerability on an isolated internal development server poses far less immediate risk than a CVSS 7.5 flaw actively weaponized by ransomware gangs against public-facing VPN gateways.

For operational prioritization, always pair CVSS base scores with:

  • CISA KEV (Known Exploited Vulnerabilities): Confirmed in-the-wild exploitation.
  • Asset Exposure: Internet-facing vs. air-gapped / internal network segment.
  • CISA SSVC: Stakeholder-Specific Vulnerability Categorization (Track, Attend, or Act).
CVE Watch Directory →CISA KEV Velocity Dashboard