Common Vulnerability Scoring System
An industry-standard 0–10 score that quantifies the severity of a software vulnerability.
Definition
The Common Vulnerability Scoring System (CVSS) is an open, industry-standard framework - currently at version 4.0 (2023) - for assigning a numeric severity score (0.0–10.0) to a software vulnerability. CVSS produces three score types: Base (intrinsic characteristics), Temporal/Threat (how exploitability evolves), and Environmental (impact in a specific deployment). NVD publishes Base scores for every CVE; manufacturers and operators apply Temporal and Environmental adjustments locally.What this means in practice
CVSS is most useful as a starting point for triage. Mature MedTech teams take the NVD Base score, apply Environmental modifiers (is the vulnerable code path reachable in our device? is the affected interface exposed?), and combine the result with clinical-harm severity from ISO 14971 to make patch-priority decisions.Examples
- A MedTech manufacturer receives an NVD alert for a critical vulnerability (CVSS Base Score 9.8) in a third-party software component. Their security team analyzes whether the vulnerable code is actually used and reachable within their medical device firmware.
- A hospital's cybersecurity team assesses a newly disclosed vulnerability with a CVSS Base Score of 7.5. They adjust this score based on their specific network configuration, determining if the affected port is open to the internet or only accessible internally, resulting in an Environmental Score of 4.3.
- During a cybersecurity incident response, a MedTech organization prioritizes patching based on a combination of high CVSS Environmental Scores and a high potential for patient harm identified through their ISO 14971 risk analysis, ensuring clinical safety takes precedence.
- •Patching by Base score alone - high-CVSS vulnerabilities in unreachable code waste cycles; low-CVSS vulnerabilities that bridge networks may be urgent.
- •Ignoring Environmental metrics - they're the whole point of bringing CVSS into a device-specific risk decision.
- •Reporting CVSS scores to operators without your VEX exploitability assessment.
Frequently asked questions
Cross-references
Related terms
Grouped by themeEditor's picks
· Hand-selected related conceptsA globally unique identifier for a publicly disclosed cybersecurity vulnerability.
A machine-readable statement that explains whether a known vulnerability is actually exploitable in a specific product.
A documented process for receiving, triaging, and responsibly disclosing security vulnerabilities reported by external researchers.
The designed-in ability to deploy security updates to a fielded medical device in a timely, controlled, and verifiable manner.
FDA Cybersecurity 101
· From this learning pathA lightweight, OWASP-maintained SBOM format designed for application security and supply-chain use cases.
The bundle of cybersecurity artifacts a sponsor includes in a 510(k), De Novo, PMA, or HDE submission for a cyber device.
FDA administrative decision that a submission is incomplete and won't be substantively reviewed.
The federal statute that gives FDA explicit premarket authority over cybersecurity for cyber devices.
Where this term appears across MedTech Terms.
- FDA Cybersecurity 101Lesson 10 of 11
Latest in MedTech
Sources
3 sourcesEvery citation below opens the original document. Each is graded against our source-tier hierarchy so you can see what rests on binding law versus commentary.
- 1FIRST CVSS v4.0 SpecificationTier 2 VerifiedFIRSTfirst.org
- 2NIST NVD CVSS CalculatorTier 2 VerifiedNISTnvd.nist.gov
- 3CISA SSVCTier 2 VerifiedCISAcisa.gov
Inline markers like [1] jump to the matching reference above.