Skip to main content
Calcimator

Vulnerability CVSS Score Calculator

Calculate CVSS v3.1 Base Score from the 8 base metrics (attack vector, complexity, privileges, user interaction, scope, and CIA impact).

Inputs

Results

CVSS Base Score

9.8

Severity (0-4)

4

Exploitability sub-score3.9
Impact sub-score5.9
Recommended SLA (hours)24
How to Use This Calculator
  1. Set Attack Vector (0=Network, 1=Adjacent, 2=Local, 3=Physical) -- network-accessible vulnerabilities score highest.
  2. Set Attack Complexity (0=Low, 1=High), Privileges Required (0=None, 1=Low, 2=High), and User Interaction (0=None, 1=Required).
  3. Set Scope (0=Unchanged, 1=Changed) and Confidentiality, Integrity, and Availability Impact.
  4. Review CVSS Base Score (0-10), Exploitability score, Impact score, and severity rating.
  5. Prioritize Critical (9.0-10) and High (7.0-8.9) findings for immediate remediation.

What each input means

Attack Vector (0-3)
0 = Network (remote), 1 = Adjacent (local network), 2 = Local (requires local access), 3 = Physical (requires physical access).
Attack Complexity (0-1)
0 = Low (no special conditions), 1 = High (requires specific configuration or race condition).
Privileges Required (0-2)
0 = None (unauthenticated), 1 = Low (basic user), 2 = High (admin/root).
User Interaction (0-1)
0 = None (no user action needed), 1 = Required (victim must click link, open file, etc.).
Scope (0-1)
0 = Unchanged (impact limited to vulnerable component), 1 = Changed (can affect other components).
Confidentiality Impact (0-2)
0 = None, 1 = Low (some data exposed), 2 = High (all data exposed).
Integrity Impact (0-2)
0 = None, 1 = Low (some data modifiable), 2 = High (all data modifiable).
Availability Impact (0-2)
0 = None, 1 = Low (degraded performance), 2 = High (complete denial of service).

What each result means

CVSS Base Score
CVSS v3.1 Base Score (0.0-10.0) per FIRST.org specification.
Exploitability sub-score
How easy the vulnerability is to exploit (0-10).
Impact sub-score
Consequence of successful exploitation (0-10).
Severity (0-4)
0 = None, 1 = Low (0.1-3.9), 2 = Medium (4.0-6.9), 3 = High (7.0-8.9), 4 = Critical (9.0-10.0).
Recommended SLA (hours)
Typical remediation SLA: Critical = 24h, High = 48h, Medium = 7 days, Low = 30 days.

How this is calculated

Worked example, using the default values

  1. Identify Input Parameters
    4 parameters
    Attack Vector (0-3) = 0, Attack Complexity (0-1) = 0, Privileges Required (0-2) = 0, User Interaction (0-1) = 0 = 8 input(s) provided
  2. Calculate CVSS Base Score
    CVSS Base Score
    9.8 = 9.8
  3. Calculate Severity
    Severity
    4 = 4
  4. Calculate Exploitability sub-score
    Exploitability sub-score = 8.22 * avVal * acVal * prVal * uiVal
    3.9 = 3.9
  5. Calculate Impact sub-score
    Impact sub-score = Math
    5.9 = 5.9

Engine last updated .

Related Calculators

The questions that sit next to this one — chosen by subject, including calculators filed under a different category.

Security Tools

Access Control Calculator

Calculate readers, controllers, credentials, and costs for a physical access control system based on door count, users, and reader technology.

Security Tools

Encryption Strength Calculator

Estimate brute-force time from key length and attacker computing power. Covers symmetric (AES) and asymmetric (RSA) algorithms with quantum threat modeling.

Security Tools

Certificate Expiration Tracker Calculator

Plan SSL/TLS certificate lifecycle management: renewal workload, annual costs, risk scoring, and alert thresholds based on your certificate portfolio.

More in Technology & Computing.