# Deepinfo Score: High Attack Complexity CVEs whose Deepinfo score has a HIGH attack complexity. Source: https://docs.deepinfo.com/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-attack-complexity/ Last updated: 2026-09-26 --- `POST https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25` CVEs whose Deepinfo score has a HIGH attack complexity. Example 7 of 22 in **Filters › Deepinfo Score** · [Vulnerability Search Examples](/reference/vulnerability/search/examples/) · endpoint: [Search](/reference/vulnerability/search/) Tags: `field` `enrichment.vdeep_metric.cvss_data.attack_complexity` · `operator` `eq` `enrichment.vdeep_metric.cvss_data.attack_complexity` is how hard the attack is (`LOW` or `HIGH`), in the Deepinfo score (`enrichment.vdeep_metric`: the CVSS metric Deepinfo uses for the CVE, from the newest CVSS version it has). `eq` matches the exact value `HIGH`. In the response, look at `results[].enrichment.vdeep_metric.cvss_data.attack_complexity`. ## Request | Parameter | In | Value | |---|---|---| | `page_size` | query | `25` | | `filters.must[0].name` | body | `enrichment.vdeep_metric.cvss_data.attack_complexity` | | `filters.must[0].type` | body | `eq` | | `filters.must[0].value` | body | `HIGH` | ```bash curl -X POST 'https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25' \ -H 'apikey: YOUR_API_KEY' \ -H 'Accept: application/json' \ -H 'Content-Type: application/json' \ -d '{ "filters": { "must": [ { "name": "enrichment.vdeep_metric.cvss_data.attack_complexity", "type": "eq", "value": "HIGH" } ] } }' ``` ## Response ### 200 · OK > Shortened for this page: results: 3 of 25 shown; results[].enrichment.cwe[].capec_id: first 10 items `Content-Type: application/json` · `ratelimit-limit: 1` · `ratelimit-remaining: 0` · `ratelimit-reset: 1` · `x-ratelimit-limit-second: 1` · `x-ratelimit-remaining-second: 0` · `deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a` ```json { "page": 1, "page_size": 25, "result_count": 26050, "results": [ { "id": "CVE-2026-93952", "source_identifier": "user@arista.com", "published": "2026-09-22T08:16:43Z", "last_modified": "2026-09-23T14:32:12Z", "status": "Analyzed", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": "2026-09-22", "cisa_action_due": "2026-09-25", "cisa_required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "cisa_vulnerability_name": "Arista VeloCloud Orchestrator Improper Input Validation Vulnerability", "descriptions": [ { "lang": "en", "value": "VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.\n\nHosted, including Dedicated, versions of VCO were impacted and have already been patched." } ], "references": [ { "url": "https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183", "source": "user@arista.com", "tags": [ "Mitigation", "Vendor Advisory" ] }, { "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-93952", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": [ "US Government Resource" ] } ], "metrics": { "cvss_metric_v40": [ { "source": "user@arista.com", "type": "Secondary", "cvss_data": { "version": "4.0", "vector_string": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack_vector": "NETWORK", "attack_complexity": "HIGH", "attack_requirements": "NONE", "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": null, "vulnerable_system_integrity": null, "vulnerable_system_availability": null, "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": "NOT_DEFINED", "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": "NOT_DEFINED", "modified_attack_complexity": "NOT_DEFINED", "modified_attack_requirements": "NOT_DEFINED", "modified_privileges_required": "NOT_DEFINED", "modified_user_interaction": "NOT_DEFINED", "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": "NOT_DEFINED", "vulnerability_response_effort": "NOT_DEFINED", "provider_urgency": "NOT_DEFINED", "base_score": 9.5, "base_severity": "CRITICAL" } } ], "cvss_metric_v31": [ { "source": "user@arista.com", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 10.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 6.0 } ], "cvss_metric_v30": null, "cvss_metric_v2": null }, "weaknesses": [ { "source": "user@arista.com", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-20" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:arista:velocloud_orchestrator:*:*:*:*:*:*:*:*", "match_criteria_id": "E90ACBD1-E408-4DD5-B8DC-D3E021FC7E7A", "version_start_including": "5.2.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "5.2.3.16" }, { "vulnerable": true, "criteria": "cpe:2.3:a:arista:velocloud_orchestrator:*:*:*:*:*:*:*:*", "match_criteria_id": "86BE5508-B49D-42FC-82E7-FCA23806DF8D", "version_start_including": "6.1.0", "version_start_excluding": null, "version_end_including": "6.1.3.7", "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:a:arista:velocloud_orchestrator:*:*:*:*:*:*:*:*", "match_criteria_id": "9592E38C-B71C-499C-9B7E-317E8E20794C", "version_start_including": "6.4.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "6.4.2.8" }, { "vulnerable": true, "criteria": "cpe:2.3:a:arista:velocloud_orchestrator:*:*:*:*:*:*:*:*", "match_criteria_id": "633BE61D-90FD-4868-9459-D4DB1B2CF653", "version_start_including": "7.0.0", "version_start_excluding": null, "version_end_including": "7.0.0.2", "version_end_excluding": null } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:arista:velocloud_orchestrator:*:*:*:*:*:*:*:*", "vendor": "arista", "product": "velocloud_orchestrator", "product_type": "a", "vulnerable": true, "version_start_including": "5.2.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "5.2.3.16", "affected_versions_first": "5.2.0", "affected_versions_last": "5.2.3.14" }, { "criteria": "cpe:2.3:a:arista:velocloud_orchestrator:*:*:*:*:*:*:*:*", "vendor": "arista", "product": "velocloud_orchestrator", "product_type": "a", "vulnerable": true, "version_start_including": "6.1.0", "version_start_excluding": null, "version_end_including": "6.1.3.7", "version_end_excluding": null, "affected_versions_first": "6.1.0", "affected_versions_last": "6.1.3.4" }, { "criteria": "cpe:2.3:a:arista:velocloud_orchestrator:*:*:*:*:*:*:*:*", "vendor": "arista", "product": "velocloud_orchestrator", "product_type": "a", "vulnerable": true, "version_start_including": "6.4.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "6.4.2.8", "affected_versions_first": "6.4.0", "affected_versions_last": "6.4.2.4" }, { "criteria": "cpe:2.3:a:arista:velocloud_orchestrator:*:*:*:*:*:*:*:*", "vendor": "arista", "product": "velocloud_orchestrator", "product_type": "a", "vulnerable": true, "version_start_including": "7.0.0", "version_start_excluding": null, "version_end_including": "7.0.0.2", "version_end_excluding": null, "affected_versions_first": "7.0.0", "affected_versions_last": "7.0.0" } ], "cwe": [ { "id": 20, "owasptop10_2021": "A03 Injection", "name": "Improper Input Validation", "description": "The product receives input or data, but it does\n not validate or incorrectly validates that the input has the\n properties that are required to process the data safely and\n correctly.", "capec_id": [ 3, 7, 8, 9, 10, 13, 14, 22, 23, 24 ], "scope": [ "Availability", "Confidentiality", "Integrity" ], "impact": [ "DoS: Crash, Exit, or Restart", "DoS: Resource Consumption (CPU)", "DoS: Resource Consumption (Memory)", "Execute Unauthorized Code or Commands", "Modify Memory", "Read Files or Directories", "Read Memory" ], "detection_method": [ "Architecture or Design Review", "Automated Static Analysis", "Automated Static Analysis - Binary or Bytecode", "Automated Static Analysis - Source Code", "Dynamic Analysis with Automated Results Interpretation", "Dynamic Analysis with Manual Results Interpretation", "Fuzzing", "Manual Static Analysis", "Manual Static Analysis - Binary or Bytecode", "Manual Static Analysis - Source Code" ] } ], "epss_score": { "epss": 0.00424, "percentile": 0.36318, "date": "2026-09-22" }, "cisa_kev": { "vendor_project": "Arista", "product": "VeloCloud Orchestrator", "vulnerability_name": "Arista VeloCloud Orchestrator Improper Input Validation Vulnerability", "date_added": "2026-09-22", "short_description": "Arista VeloCloud Orchestrator (VCO) on-prem contains an improper input validation vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.", "required_action": "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.", "due_date": "2026-09-25", "known_ransomware_campaign_use": "Unknown", "notes": "https://www.arista.com/en/support/advisories-notices/security-advisory/24765-security-advisory-0183 ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-93952" }, "vdeep_metric": { "available_versions": [ "4.0", "3.1" ], "source": "user@arista.com", "type": "Secondary", "cvss_data": { "version": "4.0", "vector_string": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack_vector": "NETWORK", "attack_complexity": "HIGH", "attack_requirements": "NONE", "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": null, "vulnerable_system_integrity": null, "vulnerable_system_availability": null, "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": "NOT_DEFINED", "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": "NOT_DEFINED", "modified_attack_complexity": "NOT_DEFINED", "modified_attack_requirements": "NOT_DEFINED", "modified_privileges_required": "NOT_DEFINED", "modified_user_interaction": "NOT_DEFINED", "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": "NOT_DEFINED", "vulnerability_response_effort": "NOT_DEFINED", "provider_urgency": "NOT_DEFINED", "base_score": 9.5, "base_severity": "CRITICAL" } } } }, { "id": "CVE-2026-92935", "source_identifier": "user@vulncheck.com", "published": "2026-09-17T14:17:57Z", "last_modified": "2026-09-17T20:18:59Z", "status": "Deferred", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "vm2 is a sandbox for running untrusted Node.js code. In versions >= 3.11.4 and <= 3.11.6, the NodeVM constructor computes `hasRealRequireConfig` with `typeof requireOpts === 'object' && requireOpts !== null`, so an array-shaped `require` value (for example `require: []`) satisfies the guard that is meant to reject nesting without an explicit require configuration. `makeResolverFromLegacyOptions()` then destructures the array into undefined option fields and returns a resolver containing only `NESTING_OVERRIDE.vm2`. As a result, an attacker who can supply JavaScript executed by a NodeVM configured with truthy `nesting` and an array-shaped `require` (e.g. `new NodeVM({nesting: true, require: []})`) can require the host `vm2` module, create an inner NodeVM with an attacker-chosen builtin allowlist (such as `child_process`), and execute arbitrary commands with the privileges of the host Node.js process, escaping the sandbox. Outer builtin restrictions do not constrain the attacker-created inner NodeVM. This issue is fixed in vm2 3.11.7." } ], "references": [ { "url": "https://github.com/patriksimek/vm2/commit/54b54b74a382577f0bcd0538c5bf99acdcd7f53b", "source": "user@vulncheck.com", "tags": null }, { "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-8hr7-r645-pc6w", "source": "user@vulncheck.com", "tags": null }, { "url": "https://www.vulncheck.com/advisories/vm2-nodevm-remote-code-execution-via-array-shaped-require", "source": "user@vulncheck.com", "tags": null } ], "metrics": { "cvss_metric_v40": [ { "source": "user@vulncheck.com", "type": "Secondary", "cvss_data": { "version": "4.0", "vector_string": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack_vector": "NETWORK", "attack_complexity": "HIGH", "attack_requirements": "PRESENT", "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": null, "vulnerable_system_integrity": null, "vulnerable_system_availability": null, "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": "NOT_DEFINED", "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": "NOT_DEFINED", "modified_attack_complexity": "NOT_DEFINED", "modified_attack_requirements": "NOT_DEFINED", "modified_privileges_required": "NOT_DEFINED", "modified_user_interaction": "NOT_DEFINED", "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": "NOT_DEFINED", "vulnerability_response_effort": "NOT_DEFINED", "provider_urgency": "NOT_DEFINED", "base_score": 9.5, "base_severity": "CRITICAL" } } ], "cvss_metric_v31": [ { "source": "user@vulncheck.com", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "HIGH", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 9.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 2.2, "impact_score": 6.0 } ], "cvss_metric_v30": null, "cvss_metric_v2": null }, "weaknesses": [ { "source": "user@vulncheck.com", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-913" } ] } ], "configurations": null, "vendor_comments": null, "enrichment": { "cpe": null, "cwe": [ { "id": 913, "owasptop10_2021": "A01 Broken Access Control", "name": "Improper Control of Dynamically-Managed Code Resources", "description": "The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements.", "capec_id": null, "scope": [ "Integrity", "Other" ], "impact": [ "Alter Execution Logic", "Execute Unauthorized Code or Commands", "Varies by Context" ], "detection_method": [ "Fuzzing" ] } ], "epss_score": { "epss": 0.005, "percentile": 0.41722, "date": "2026-09-21" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "4.0", "3.1" ], "source": "user@vulncheck.com", "type": "Secondary", "cvss_data": { "version": "4.0", "vector_string": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack_vector": "NETWORK", "attack_complexity": "HIGH", "attack_requirements": "PRESENT", "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": null, "vulnerable_system_integrity": null, "vulnerable_system_availability": null, "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": "NOT_DEFINED", "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": "NOT_DEFINED", "modified_attack_complexity": "NOT_DEFINED", "modified_attack_requirements": "NOT_DEFINED", "modified_privileges_required": "NOT_DEFINED", "modified_user_interaction": "NOT_DEFINED", "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": "NOT_DEFINED", "vulnerability_response_effort": "NOT_DEFINED", "provider_urgency": "NOT_DEFINED", "base_score": 9.5, "base_severity": "CRITICAL" } } } }, { "id": "CVE-2026-92934", "source_identifier": "user@vulncheck.com", "published": "2026-09-17T14:17:57Z", "last_modified": "2026-09-17T15:17:00Z", "status": "Deferred", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within a single exception handler traversal. Attackers can exploit cycle detection bypass in handleException to access unsanitized host proxies embedded in the errors array, enabling full remote code execution and process information disclosure from the sandbox." } ], "references": [ { "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-x965-fc75-jpqh", "source": "user@vulncheck.com", "tags": null }, { "url": "https://www.vulncheck.com/advisories/vm2-before-3.11.8-sandbox-escape-rce-via-aggregateerror", "source": "user@vulncheck.com", "tags": null }, { "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-x965-fc75-jpqh", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": null } ], "metrics": { "cvss_metric_v40": [ { "source": "user@vulncheck.com", "type": "Secondary", "cvss_data": { "version": "4.0", "vector_string": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack_vector": "NETWORK", "attack_complexity": "HIGH", "attack_requirements": "PRESENT", "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": null, "vulnerable_system_integrity": null, "vulnerable_system_availability": null, "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": "NOT_DEFINED", "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": "NOT_DEFINED", "modified_attack_complexity": "NOT_DEFINED", "modified_attack_requirements": "NOT_DEFINED", "modified_privileges_required": "NOT_DEFINED", "modified_user_interaction": "NOT_DEFINED", "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": "NOT_DEFINED", "vulnerability_response_effort": "NOT_DEFINED", "provider_urgency": "NOT_DEFINED", "base_score": 9.5, "base_severity": "CRITICAL" } } ], "cvss_metric_v31": [ { "source": "user@vulncheck.com", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "HIGH", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 9.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 2.2, "impact_score": 6.0 } ], "cvss_metric_v30": null, "cvss_metric_v2": null }, "weaknesses": [ { "source": "user@vulncheck.com", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-693" } ] } ], "configurations": null, "vendor_comments": null, "enrichment": { "cpe": null, "cwe": [ { "id": 693, "owasptop10_2021": null, "name": "Protection Mechanism Failure", "description": "The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.", "capec_id": [ 1, 17, 20, 22, 36, 51, 57, 59, 65, 74 ], "scope": [ "Access Control" ], "impact": [ "Bypass Protection Mechanism" ], "detection_method": null } ], "epss_score": { "epss": 0.0074, "percentile": 0.52693, "date": "2026-09-21" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "4.0", "3.1" ], "source": "user@vulncheck.com", "type": "Secondary", "cvss_data": { "version": "4.0", "vector_string": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack_vector": "NETWORK", "attack_complexity": "HIGH", "attack_requirements": "PRESENT", "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": null, "vulnerable_system_integrity": null, "vulnerable_system_availability": null, "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": "NOT_DEFINED", "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": "NOT_DEFINED", "modified_attack_complexity": "NOT_DEFINED", "modified_attack_requirements": "NOT_DEFINED", "modified_privileges_required": "NOT_DEFINED", "modified_user_interaction": "NOT_DEFINED", "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": "NOT_DEFINED", "vulnerability_response_effort": "NOT_DEFINED", "provider_urgency": "NOT_DEFINED", "base_score": 9.5, "base_severity": "CRITICAL" } } } } ] } ``` ## Related Examples - [Deepinfo Score: Physical Attack Vector](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-attack-vector/) - [Deepinfo Score: Attack Requirements Present](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-attack-requirements/) - [Deepinfo Score Vector: Classic 9.8](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-vector-string/) - [Deepinfo Score: High Privileges Required](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-privileges-required/) - [Deepinfo Score From CVSS v2](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-version/) - [Deepinfo Score: User Interaction Required](/reference/vulnerability/search/examples/enrichment-vdeep-metric-cvss-data-user-interaction/)