🚧 Under construction — VoTechWorks is being built. A free tech program — complimentary, as our commitment to get America working.
voTechWorksGrade 13 · a vocational technology learning center, by urbanicity
newSchoolWorks.com › VoTechWorks › Technology & Design › Cybersecurity › Security Operations: Monitoring, Defense, and Controls › Lesson 10
TEC-CYBE44-03 · Lesson 10 · 16 clock hours · lab

Vulnerability Scanning and CVSS-Based Prioritization

Objective. Students will run a credentialed vulnerability scan against a lab target, interpret the results using the Common Vulnerability Scoring System (CVSS), and produce a prioritized remediation plan.

⚠ Pending professional review

This lesson, its worked examples and its practice questions has not yet been verified by an industry-certified professional or by a certification or approval body. It is a study draft and may contain errors. Do not use it as instructions for work on a job site or on live equipment. Always follow your instructor, your supervising professional, and current official references and regulations.

VoTechWorks program approval and accreditation are still in progress. Credentials are issued only by the certifying bodies named in each program, after their own exams.

Why Vulnerability Scanning Matters

Every network contains software with flaws. Attackers search for those flaws constantly. Vulnerability scanning lets defenders find weaknesses first, measure how serious each one is, and fix the most dangerous issues before they are exploited. A credentialed scan — one that logs into the target system with valid credentials — gives a far more complete picture than an unauthenticated scan because the scanner can read installed software versions, patch levels, and configuration settings directly.

How OpenVAS / Greenbone Community Edition Works

OpenVAS (Open Vulnerability Assessment System), now maintained as Greenbone Community Edition, is an open-source vulnerability scanner that maintains a regularly updated feed of Network Vulnerability Tests (NVTs). The scanner operates from a central manager that schedules tasks, stores results, and generates reports. Key concepts:

Before scanning any system, confirm you have written authorization. Scanning systems you do not own or have explicit permission to test is illegal under the Computer Fraud and Abuse Act and similar laws. In this lab, your target is a deliberately vulnerable VM — such as Metasploitable — running on an isolated local network. Never connect a deliberately vulnerable VM to the internet.

Lab Safety and Network Isolation

Deliberately vulnerable VMs contain known, unpatched flaws by design. Treat them with the same care you would an explosive: keep them on a host-only or internal virtual network, powered off when not in use, and never bridged to a production or internet-connected interface. Confirm your VM network settings before powering on. This is the digital equivalent of lockout/tagout — isolating the hazard before working on it.

The Common Vulnerability Scoring System (CVSS)

CVSS v3.1 is an open framework maintained by FIRST (Forum of Incident Response and Security Teams) and used by NIST's National Vulnerability Database (NVD) to assign standardized severity scores to software vulnerabilities. A CVSS base score ranges from 0.0 to 10.0 and is derived from two groups of metrics.

Exploitability Metrics

These describe how easy it is for an attacker to reach and leverage the vulnerability:

Impact Metrics

These describe what happens if exploitation succeeds:

Severity Ratings

| Score Range | Severity |

|---|---|

| 0.0 | None |

| 0.1 – 3.9 | Low |

| 4.0 – 6.9 | Medium |

| 7.0 – 8.9 | High |

| 9.0 – 10.0 | Critical |

Always use CVSS scores as a starting point, not a final answer. Temporal and environmental factors — such as whether a public exploit exists or whether compensating controls are already in place — can raise or lower effective priority.

Prioritizing Remediation

With a real scan you may receive dozens or hundreds of findings. A practical prioritization approach:

1. Sort by CVSS base score descending to surface the most severe findings first.

2. Check exploitability metrics: A Critical-score vulnerability that requires physical access may be less urgent than a High-score vulnerability exploitable remotely with no privileges required.

3. Assess business impact: A vulnerability on a public-facing web server is higher priority than the same vulnerability on an isolated internal workstation.

4. Confirm patch availability: If a vendor patch exists and can be applied quickly, do it. If not, identify a workaround or compensating control.

5. Document your reasoning so stakeholders understand why some issues are addressed before others.

Writing an Executive Summary

An executive summary remediation plan is written for a non-technical manager, not for a fellow security analyst. Keep it to one page. Use plain language, avoid jargon, and focus on business risk and action items. Structure it as:

Avoid phrases like "CVSS AV:N/AC:L" in an executive summary. Translate technical findings into business consequences.

Key terms10

Credentialed scanA vulnerability scan that logs into the target system with valid credentials, allowing the scanner to inspect installed software versions, patch levels, and local configurations directly rather than inferring them from network responses.
CVSS (Common Vulnerability Scoring System)An open, standardized framework maintained by FIRST that assigns a numerical severity score from 0.0 to 10.0 to software vulnerabilities based on exploitability and impact characteristics.
Base scoreThe CVSS score derived solely from intrinsic vulnerability characteristics — exploitability and impact metrics — independent of time or environment.
Attack Vector (AV)A CVSS exploitability metric that describes how an attacker reaches the vulnerable component; options are Network, Adjacent, Local, and Physical, with Network being the most severe.
Scope (S)A CVSS metric that indicates whether successful exploitation can affect resources beyond the vulnerable component itself; a value of 'Changed' typically increases the score.
NVT (Network Vulnerability Test)An individual test plug-in within OpenVAS / Greenbone that checks a target for a specific known vulnerability or misconfiguration.
MetasploitableA deliberately vulnerable Linux virtual machine designed for practicing penetration testing and vulnerability scanning in a safe, isolated lab environment.
Remediation planA documented list of actions, priorities, owners, and timelines for fixing or mitigating identified vulnerabilities, often including an executive summary for management stakeholders.
NVD (National Vulnerability Database)The U.S. government repository of standards-based vulnerability data, maintained by NIST, that publishes CVSS scores and other details for publicly disclosed vulnerabilities.
Compensating controlAn alternative security measure implemented when the primary remediation — such as a vendor patch — is not immediately available, intended to reduce the risk of exploitation in the interim.

Worked examples4

1. A scan finding has the following CVSS v3.1 base metrics: AV:N, AC:L, PR:N, UI:N, S:U, C:H, I:H, A:H. Use the NIST NVD CVSS v3.1 calculator logic to determine the qualitative severity rating.
  1. Identify exploitability metrics: Attack Vector = Network (most permissive), Attack Complexity = Low, Privileges Required = None, User Interaction = None. These all favor high exploitability.
  2. Identify impact metrics: Confidentiality = High, Integrity = High, Availability = High. All three impact categories are at their maximum.
  3. Note that Scope = Unchanged, meaning only the vulnerable component itself is affected, which places a ceiling on the score but all other inputs are at maximum severity.
  4. Enter these values into the NIST NVD CVSS v3.1 calculator. The calculator returns a base score of 9.8.
  5. Map 9.8 to the severity table: 9.0–10.0 = Critical.
Answer: The vulnerability receives a CVSS v3.1 base score of 9.8, rated Critical. This finding should be placed at the top of the remediation priority list.
2. Two findings appear in a scan report. Finding A has CVSS base score 9.8 (AV:N, AC:L, PR:N, UI:N). Finding B has CVSS base score 9.1 (AV:N, AC:L, PR:H, UI:N). Which should be remediated first and why?
  1. Compare base scores: Finding A = 9.8, Finding B = 9.1. Both are Critical.
  2. Compare exploitability: Finding A requires no privileges (PR:N); an unauthenticated attacker on the internet can exploit it immediately. Finding B requires high privileges (PR:H), meaning an attacker must already have admin-level access to exploit it.
  3. Conclude that Finding A presents a greater risk because it is reachable by any unauthenticated attacker, widening the pool of potential attackers dramatically compared to Finding B.
Answer: Finding A (score 9.8, PR:N) should be remediated first. Although both scores are Critical, Finding A's lack of authentication requirement makes it far more likely to be exploited in the wild.
3. A finding shows CVSS base score 7.5 but the system it affects is behind a firewall that blocks all inbound traffic on the vulnerable port. A second finding shows CVSS base score 6.8 on a public-facing web server with no firewall restriction. Which should be treated as higher priority?
  1. Recognize that CVSS base scores do not account for environmental factors such as network controls.
  2. Apply environmental reasoning: The 7.5-score vulnerability has a compensating control (firewall) that blocks the attack path. Effective exploitability is significantly reduced.
  3. The 6.8-score vulnerability is fully exposed on a public-facing server with no firewall restriction; the attack path is open to any internet user.
  4. Prioritize the 6.8 finding on the public-facing server because the real-world exploitability is higher despite the lower base score.
Answer: The 6.8-score finding on the unprotected public-facing server should be treated as higher priority. Compensating controls on the 7.5-score system reduce its practical risk below that of the fully exposed system.
4. You have five scan findings with CVSS base scores of 9.8, 8.1, 7.4, 6.5, and 4.2. Rank them in remediation priority order from highest to lowest.
  1. Sort numerically from highest score to lowest score: 9.8 → 8.1 → 7.4 → 6.5 → 4.2.
  2. Assign severity labels: 9.8 = Critical; 8.1 = High; 7.4 = High; 6.5 = Medium; 4.2 = Medium.
  3. Note that findings with the same qualitative rating should be further differentiated by exploitability metrics (AV, AC, PR, UI) and business context if available.
Answer: Priority order: 1st = 9.8 (Critical), 2nd = 8.1 (High), 3rd = 7.4 (High), 4th = 6.5 (Medium), 5th = 4.2 (Medium). Apply additional exploitability and environmental analysis for findings sharing a severity tier.
In class: Configure and launch a credentialed scan using OpenVAS or Greenbone Community Edition against a deliberately vulnerable lab VM (e.g., Metasploitable), then export the report. · Select five findings from the scan report, look up or record their CVSS base scores, and rank them in remediation priority order with written justification referencing exploitability and impact metrics. · Draft a one-page executive-summary remediation plan addressed to a fictional IT manager, explaining the top three vulnerabilities in plain language and recommending specific corrective actions with estimated effort.
Materials: OpenVAS / Greenbone Community Edition, Metasploitable or equivalent deliberately vulnerable VM, CVSS v3.1 scoring calculator (publicly available at NIST NVD), report template.
Check: Scan is successfully completed and report exported; CVSS prioritization is correctly ordered with accurate score references; executive summary is clear, accurate, and professionally written; lab graded at 75% or higher.

Practice check8

Answer each question, then check it. Nothing is recorded; this is your own practice.

CompTIA Security+ – Threats, Vulnerabilities, and Mitigations
1. Which type of vulnerability scan provides the most complete view of installed software and missing patches on a target system?
CompTIA CySA+ – Vulnerability Management
2. A CVSS v3.1 base score of 9.4 falls into which severity category?
CompTIA Security+ – Threats, Vulnerabilities, and Mitigations
3. Which CVSS v3.1 Attack Vector value represents the greatest ease of exploitation from an attacker's perspective?
CompTIA CySA+ – Vulnerability Management
4. A vulnerability has CVSS metrics AV:N, AC:L, PR:N, UI:N, S:C, C:H, I:H, A:H. What does the Scope value of 'Changed' indicate?
ISC2 CC – Security Controls
5. When running a deliberately vulnerable VM such as Metasploitable in a lab, which network configuration is most appropriate for safety?
CompTIA CySA+ – Vulnerability Management
6. An analyst finds two Critical vulnerabilities. Vulnerability X has PR:N (no privileges required); Vulnerability Y has PR:H (high privileges required). All other metrics are identical. Which should be remediated first?
CompTIA Security+ – Security Program Management and Oversight
7. An executive summary remediation plan is best described as:
CompTIA CySA+ – Vulnerability Management
8. A firewall blocks all inbound traffic on port 445 to a server with a High-severity SMB vulnerability (CVSS 8.5). A second server has a Medium-severity web application vulnerability (CVSS 6.2) exposed directly to the internet on port 443. Which finding warrants immediate remediation attention?
Record this lesson on my transcript. Sign in with your key and enrollment email to record lessons (enroll free if you have no key). This page stays open to read and practise.
← Previous lessonProgram planNext lesson →