SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/secplus-cvss-attack-vector-network

In CVSS, which Attack Vector value scores highest because the attacker can be anywhere on the internet?

Network. The more remote the attacker can be, the higher the score.

Start playing free

  1. Adjacent
  2. Physical
  3. Network ✔

Why: The Attack Vector metric describes how close an attacker must be. Network means exploitation from the internet, so it scores highest. Physical requires touching the device and scores lowest.

Huh, didn't know that: FIRST gives a cold boot attack on disk encryption keys as an example of a Physical vector.

The dad joke
My Internet stopped working for 5 minutes. Met my parents. They're nice people.
Like this card?
Play the game

References

Answer: Network. The Attack Vector metric describes how close an attacker must be. Network means exploitation from the internet, so it scores highest. Physical requires touching the device and scores lowest.

  1. FIRST CVSS v4.0 Specification Document www.first.org/cvss/v4.0/specification-document
    will be larger the more remote (logically, and physically) an attacker can be
    Checked 2026-10-10.
  2. FIRST CVSS v4.0 Specification Document www.first.org/cvss/v4.0/specification-document
    The attack requires the attacker to physically touch or manipulate the vulnerable system.
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyOn the CVSS qualitative severity scale, which Base Score range is rated Critical?Security & PrivacyIn CVSS v4.0, which metric group covers characteristics that change over time, such as exploit code becoming available?Security & PrivacyIn CVSS v4.0, what effect do Supplemental metrics have on the final score?

That's stuff everyone should know.