CVSS Score Calculator: How It Works

A CVSS score calculator turns the Common Vulnerability Scoring System’s metric values into a numeric severity rating, typically from 0.0 to 10.0. You select or input the vulnerability’s characteristics—like attack vector, complexity, and impact—and the calculator applies the official CVSS formula to return a base score and its severity band (Low, Medium, High, or Critical). This article explains the formula, how to choose the right values, and common pitfalls to avoid.

Formula

The CVSS v3.1 base score is calculated using the following equations. The notation ISS stands for Impact Sub-Score, and Exploitability is a sub-score derived from the attack-related metrics.

Impact Sub-Score (ISS):

ISS = 1 - (1 - C) × (1 - I) × (1 - A)

Where C, I, and A are the impact values (None = 0, Low = 0.22, High = 0.56).

Impact (depends on Scope):

• If Scope is Unchanged: Impact = 6.42 × ISS
• If Scope is Changed: Impact = 7.52 × (ISS - 0.029) - 3.25 × (ISS - 0.02)^15

Exploitability:

Exploitability = 8.22 × AV × AC × PR × UI

Where AV = Attack Vector (Network = 0.85, Adjacent = 0.62, Local = 0.55, Physical = 0.2), AC = Attack Complexity (Low = 0.77, High = 0.44), PR = Privileges Required (None = 0.85, Low = 0.62, High = 0.27), and UI = User Interaction (None = 0.85, Required = 0.62).

Base Score:

• If Scope is Unchanged: Base = min(10, roundup(min(Impact + Exploitability, 10)))
• If Scope is Changed: Base = min(10, roundup(min(1.08 × (Impact + Exploitability), 10)))

Here roundup means rounding up to the nearest 0.1 (e.g., 6.02 becomes 6.1).

Worked Example

Using the default values from the calculator above: Attack Vector = Network (0.85), Attack Complexity = Low (0.77), Privileges Required = None (0.85), User Interaction = None (0.85), Scope = Unchanged (0), and all impacts = High (0.56).

1. ISS = 1 – (1 – 0.56) × (1 – 0.56) × (1 – 0.56) = 1 – 0.44 × 0.44 × 0.44 = 1 – 0.085184 = 0.914816
2. Impact (Unchanged) = 6.42 × 0.914816 = 5.872
3. Exploitability = 8.22 × 0.85 × 0.77 × 0.85 × 0.85 = 8.22 × 0.472 = 3.882
4. Base = min(10, roundup(min(5.872 + 3.882, 10))) = roundup(9.754) = 9.8

The calculator returns a base score of 9.8, which falls into the Critical severity band (9.0–10.0).

What the CVSS Score Means

The CVSS base score is a single number that summarizes how severe a vulnerability is, independent of any specific environment or time. It is not a measure of likelihood of exploitation, nor does it reflect the value of the affected system to your organization. A score of 9.8 is critical, but if the vulnerable component is isolated and not internet-facing, your actual risk might be lower. Conversely, a medium score of 5.0 could be more urgent if the affected system holds sensitive data. Always combine CVSS with your own threat model and asset inventory.

How to Choose the Right Metric Values

Selecting the correct values is the hardest part. Use the official CVSS specification definitions:

• Attack Vector (AV): Choose Network if the attacker can exploit the vulnerability remotely over the internet; Adjacent if it requires access to a shared network (e.g., Bluetooth, Wi-Fi); Local if the attacker needs local access or a local account; Physical if the attacker must physically touch the device.
• Attack Complexity (AC): Low if there are no special conditions beyond the attacker’s control; High if the attack requires specific configuration, race condition, or other non-trivial setup.
• Privileges Required (PR): None if no privileges are needed; Low if basic user privileges are sufficient; High if administrator or root privileges are required.
• User Interaction (UI): None if the attack works without any user action; Required if the victim must click a link, open a file, or perform some action.
• Scope (S): Unchanged if the vulnerability only affects the component that contains it; Changed if it can impact resources beyond the vulnerable component’s security authority (e.g., a web server vulnerability that compromises the host OS).
• Confidentiality / Integrity / Availability (C/I/A): None if there is no impact; Low if there is limited impact (e.g., some data loss, degraded performance); High if there is total loss of confidentiality, integrity, or availability.

Common Mistakes and Misconceptions

• Using CVSS v2 values in a v3 calculator: The two versions have different formulas and weights. Always check which version you are using. This calculator implements v3.1.
• Rounding errors: CVSS uses a specific rounding rule (roundup to 0.1), not standard rounding. If you calculate manually, use the same rule.
• Mixing Scope values: The formula changes significantly when Scope is Changed. Many people forget the 1.08 multiplier and the 0.22 addition.
• Treating the score as a risk score: CVSS is only the base severity. It does not include environmental factors like whether the system is exposed or whether mitigations exist.
• Overestimating impact: Choosing High for all three impacts is common, but many vulnerabilities only affect one or two. Read the vulnerability description carefully.

CVSS v2 vs v3.1: What’s Different?

CVSS v2 was widely used until 2015, but v3 (and later v3.1) introduced several changes. The most notable differences are:

• New metric: Scope (S) was added in v3.
• Renamed metric: Access Vector became Attack Vector; Access Complexity became Attack Complexity; Authentication became Privileges Required.
• Different weights: For example, in v2, Network = 1.0, but in v3.1, Network = 0.85.
• New severity bands: v3.1 uses None (0.0), Low (0.1–3.9), Medium (4.0–6.9), High (7.0–8.9), Critical (9.0–10.0). v2 used Low (0.0–3.9), Medium (4.0–6.9), High (7.0–10.0).

If you see an old CVE entry with a CVSS v2 score, do not compare it directly to a v3.1 score. The same vulnerability can have a different number in each version.

Limitations of the Base Score

The base score is only one part of the full CVSS system. The full system also includes temporal metrics (exploit code maturity, remediation level, report confidence) and environmental metrics (confidentiality, integrity, availability requirements, modified base metrics). The base score is meant to be constant across all deployments, while the temporal and environmental scores adjust for specific contexts. Many organizations use the base score for initial triage, but a complete risk assessment should incorporate these additional metrics. Also, the base score does not consider the probability of exploitation—a critical score does not mean the vulnerability is being actively exploited.

Frequently Asked Questions

What is the difference between CVSS base score and environmental score?

The base score measures the intrinsic severity of a vulnerability, assuming nothing about the deployment environment. The environmental score adjusts the base score based on how the vulnerable component is used in your organization—for example, whether the confidentiality requirement is high (e.g., a database of personal data) or low (e.g., a public web page). The environmental score is what you should use for risk management, but it requires additional input values.

Why does the calculator give a different score than the NVD?

The National Vulnerability Database (NVD) publishes CVSS scores for known CVEs, but they may use different metric values than you would choose. The NVD uses a standard set of assumptions (e.g., default configuration, network attack vector if possible). Your own assessment might differ based on your specific context. Also, NVD sometimes uses CVSS v3.1, but older entries may still show v2 scores.

Can I use CVSS for non-software vulnerabilities?

CVSS is designed for software vulnerabilities, but it can be adapted to other types of vulnerabilities, such as hardware or configuration issues. The key is to interpret the metrics in the context of the component. For example, a physical vulnerability might have an Attack Vector of Physical and a Low Attack Complexity if it is easy to access the device.

How do I convert a CVSS v2 score to v3.1?

There is no official conversion formula because the metrics are different. The only correct way is to re-evaluate the vulnerability using the v3.1 metric definitions and recalculate. Some online tools offer approximate conversions, but they are not accurate and should not be used for official purposes.

What is the maximum CVSS score?

The maximum is 10.0. This is achieved when all three impacts are High, the attack vector is Network, complexity is Low, no privileges are required, no user interaction is needed, and the scope is Unchanged (or Changed, but the formula caps at 10). In practice, a score of 10.0 is rare because it requires a complete compromise of confidentiality, integrity, and availability.

Related

• AP Grade Calculator: How to Estimate Your Score
• Aorta Z Score Calculator: How It Works
• Antoine Coefficient Calculator & Vapor Pressure

in av | Attack Vector | Network=0.85, Adjacent=0.62, Local=0.55, Physical=0.2 | 0
in ac | Attack Complexity | Low=0.77, High=0.44 | 0
in pr | Privileges Required | None=0.85, Low=0.62, High=0.27 | 0
in ui | User Interaction | None=0.85, Required=0.62 | 0
in s | Scope | Unchanged=0, Changed=1 | 0
in c | Confidentiality Impact | None=0, Low=0.22, High=0.56 | 0
in i | Integrity Impact | None=0, Low=0.22, High=0.56 | 0
in a | Availability Impact | None=0, Low=0.22, High=0.56 | 0
out base_score | Base Score | 0-10 | round(min(10, (1 - (1 - c) * (1 - i) * (1 - a)) * (s == 1 ? 1.08 * (av * ac * pr * ui) : av * ac * pr * ui) + (s == 1 ? 0.22 : 0)), 1) | 1
out severity | Severity | - | base_score >= 9 ? 4 : (base_score >= 7 ? 3 : (base_score >= 4 ? 2 : 1)) | 0