200-201 Question 69
Select 2You are analyzing a recently disclosed vulnerability using the CVSS framework. The vulnerability allows remote attackers to execute arbitrary code on a system without requiring authentication. You observe that the attack complexity is low, and the exploit can be launched over the network. Which CVSS metric values should you assign to the Attack Vector (AV) and Privileges Required (PR) metrics?
- A
Attack Vector (AV): Network
- B
Attack Vector (AV): Physical
- C
Privileges Required (PR): None
- D
Privileges Required (PR): High
- E
Privileges Required (PR): Low
Show answer and explanation
Correct answers: A, C
Explanation
In the CVSS framework, the Attack Vector (AV) metric describes how the vulnerability can be exploited. A value of 'Network' is appropriate when the exploit is possible over a network connection. The Privileges Required (PR) metric indicates the level of access needed by an attacker to exploit the vulnerability. A value of 'None' is correct when no authentication or privileges are required to execute the attack.
- A. Correct.
Attack Vector (AV): Network is correct because the exploit can be launched remotely over the network, as stated in the scenario.
- B. Incorrect.
Attack Vector (AV): Physical is incorrect because the vulnerability does not require physical access to the system.
- C. Correct.
Privileges Required (PR): None is correct because the attacker does not need any authentication or privileges to exploit the vulnerability.
- D. Incorrect.
Privileges Required (PR): High is incorrect because the vulnerability does not require administrative or high-level privileges to execute.
- E. Incorrect.
Privileges Required (PR): Low is incorrect because the scenario explicitly states that no privileges are required to exploit the vulnerability.