NIST tools

CVSS vector viewer

Parse CVSS 3.1 and 4.0 vector strings, view base scores and severity, explore each metric, and export the scorecard as text or an image.

← All tools

Vector

CVSS vector string

Paste your CVSS vector string

Quick examples

CVSS 4.0 scorecard

Base score, severity, and metric breakdown

Score

5.4

Severity

Medium

Version

CVSS 4.0

Huntertech.io

Report generated: May 23, 2026 at 04:00 AM

Vector String:

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:L/SI:N/SA:L

AV:A

Adjacent Network

Requires access to adjacent network (e.g., same subnet).

Attack Vector

AC:L

Low

No special circumstances required; straightforward.

Attack Complexity

AT:N

None

No special configuration or state required on the target.

Attack Requirements

PR:N

None

No access needed.

Privileges Required

UI:N

None

Exploit possible without user help.

User Interaction

VC:L

Low

Partial/limited breach.

Vulnerability Confidentiality Impact

VI:N

None

No impact on integrity.

Vulnerability Integrity Impact

VA:L

Low

Partial/limited breach.

Vulnerability Availability Impact

SC:L

Low

Limited impact on assets beyond the original vulnerable component.

Subsequent Confidentiality Impact

SI:N

None

No impact on integrity beyond the vulnerable component.

Subsequent Integrity Impact

SA:L

Low

Limited impact on assets beyond the original vulnerable component.

Subsequent Availability Impact

Understanding CVSS Metrics

Welcome to CVSS

1 / 10

The Common Vulnerability Scoring System (CVSS) is a NIST-supported framework for capturing how exploitable a vulnerability is and how bad the impacts can be, then rolling that into one base score so security and engineering teams can prioritize fixes consistently.

At a glance

Three ideas that show up everywhere in CVSS tooling.

Base score

0.0 – 10.0

A single number derived from the vector; higher usually means worse risk in the model.

Vector string

Metrics in one line

Attack path, privileges, user help, scope or follow-on impacts, encoded as compact METRIC:VALUE pairs.

Versions

3.1 and 4.0

This tool parses both. 4.0 adds finer metrics (e.g. attack requirements, subsequent impacts); 3.1 is still widely published on CVEs.

Quick tip: In CVSS, a higher base score means the vulnerability is modeled as more severe; triage and patch priority should reflect your own policy, but the score is the common yardstick.

Understanding Vector Strings

2 / 10

A CVSS vector string encodes every base metric used to compute the score from exploit conditions, privileges, user interaction, and confidentiality / integrity / availability impacts, in one parseable line.

Structure

After the version token, segments are slash-separated; each is METRIC:VALUE per the spec.

CVSS:VERSION/METRIC:VALUE/METRIC:VALUE/...

Prefix: CVSS: marks this as a CVSS vector (not CVSS-BE or another profile).
Version: 3.1 or 4.0 selects the metric set and scoring formula (yours: 4.0).
Metric pairs: Examples: AV:N, PR:H, C:H… Each pair maps to one defined choice in the CVSS specification; the parser uses them to derive the base score.

Your current vector

CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:L/SI:N/SA:L

The following steps walk through each metric group (attack, scope or requirements, impacts) in the same order you'll see on the scorecard below.

Attack Vector (AV)

3 / 10

Attack Vector describes how a vulnerability can be exploited: how reachable the vulnerable component is to an attacker.

Attack vector values

NNetwork

Can be exploited remotely over the internet; highest exposure in this metric.

AAdjacent network

Requires access to a shared limited network (e.g. same subnet), not the whole internet.

LLocal

Attacker must have local access (e.g. shell, session) on the affected system.

PPhysical

Requires physical proximity or contact with the device (e.g. USB, console).

Attack Complexity (AC)

4 / 10

Attack Complexity captures whether special conditions must hold for exploitation to succeed.

Complexity values

LLow

No specialized conditions; exploit can be performed readily and reliably.

HHigh

Specific circumstances, timing, or environment constraints must be met.

Privileges Required (PR)

5 / 10

Privileges Required is the level of account or rights needed before exploitation can succeed.

Privilege levels

NNone

No authentication or prior access, often the worst case for exploitability.

LLow

Limited access such as a standard user account may be enough.

HHigh

Elevated privileges (e.g. admin/root) are required, which narrows who can exploit it.

User Interaction (UI)

6 / 10

User Interaction states whether a person must help the attack (open a file, click a link, etc.).

User interaction

NNone

Exploit can run without the victim performing a deliberate action.

RRequired

A user must take an action (e.g. open a malicious document) for exploitation to occur.

Attack Requirements (AT)

7 / 10

Attack Requirements capture whether the target must be in a specific configuration or state for exploitation to work.

Attack requirements (CVSS 4.0)

NNone

No special configuration or prerequisite state on the vulnerable system.

PPresent

Certain conditions in the environment must exist for the exploit to succeed.

Vulnerability Impacts (VC/VI/VA)

8 / 10

Vulnerability Impacts measure confidentiality, integrity, and availability for the vulnerable component itself (VC, VI, VA in CVSS 4.0).

Direct impacts on the vulnerable component

NNone

No impact on this property for the vulnerable component.

LLow

Partial or limited breach of this property.

HHigh

Serious breach (e.g. full data exposure, total loss of control for that property).

Subsequent Impacts (SC/SI/SA)

9 / 10

Subsequent Impacts describe harm to assets beyond the originally vulnerable component, replacing the old Scope notion with explicit metrics.

Impacts beyond the vulnerable component

NNone

No downstream impact outside the vulnerable component.

LLow

Limited additional impact elsewhere in the environment.

HHigh

Significant broader impact (e.g. lateral movement, wide compromise).

Understanding Scores

10 / 10

CVSS scores help organizations prioritize vulnerabilities. Here's how to interpret the base score range:

Base score bands

None (0.0)

No exploitability, no impact; safely ignored.

Low (0.1–3.9)

Little real-world risk. Patch on routine schedule.

Medium (4.0–6.9)

Moderate risk. Evaluate business impact, address within normal cycle.

High (7.0–8.9)

Significant risk. Prioritize for remediation, consider immediate mitigations.

Critical (9.0–10.0)

Highest risk. Must remediate urgently to prevent likely compromise.

How scores are used

None (0.0):No exploitability, no impact; safely ignored.

Low (0.1–3.9):Little real-world risk. Patch on routine schedule.

Medium (4.0–6.9):Moderate risk. Evaluate business impact, address within normal cycle.

High (7.0–8.9):Significant risk. Prioritize for remediation, consider immediate mitigations.

Critical (9.0–10.0):Highest risk. Must remediate urgently to prevent likely compromise.

CVSS 4.0 vectors and metrics help security teams better match real-world exploitability and organizational risk, with more detail and context than any previous version. Scores change in finer increments (minimum 0.1 per change), providing more granularity when comparing vulnerabilities.

What's new in CVSS 4.0

No "Scope" metric:The confusing "Scope" variable was removed in favor of explicitly describing subsequent impacts (SC/SI/SA).

Attack requirements (AT):New metric that indicates if specific configuration or prerequisites are needed for exploitation.

Subsequent impacts (SC/SI/SA):Measures impact on assets beyond the original vulnerable component (e.g., broader domain compromise).

Supplemental metrics:Provide further context such as safety impact, attacker automation, and recovery, but don't affect the Base score.

Expanded threat/environmental scoring:Makes it easier to score based on real-world exploit data or asset criticality, supporting richer, asset-aware risk assessment.

Learn more

The Common Vulnerability Scoring System (CVSS) provides a way to capture the principal characteristics of a vulnerability and produce a numerical score reflecting its severity. The vector string contains all the information needed to calculate the base score, which ranges from 0.0 to 10.0.

For official CVSS specifications and detailed scoring formulas, visit: first.org/cvss