# CVSS v3.1: High Attack Complexity CVEs whose CVSS v3.1 attack complexity is HIGH. Source: https://docs.deepinfo.com/reference/vulnerability/search/examples/metrics-cvss-metric-v31-cvss-data-attack-complexity/ Last updated: 2026-09-26 --- `POST https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25` CVEs whose CVSS v3.1 attack complexity is HIGH. Example 6 of 16 in **Filters › CVSS v3.1** · [Vulnerability Search Examples](/reference/vulnerability/search/examples/) · endpoint: [Search](/reference/vulnerability/search/) Tags: `field` `metrics.cvss_metric_v31.cvss_data.attack_complexity` · `operator` `eq` `metrics.cvss_metric_v31.cvss_data.attack_complexity` is how hard the attack is (`LOW` or `HIGH`), in the CVSS v3.1 metric (`metrics.cvss_metric_v31`, one entry per scoring source). `eq` matches the exact value `HIGH`. In the response, look at `results[].metrics.cvss_metric_v31[].cvss_data.attack_complexity`. ## Request | Parameter | In | Value | |---|---|---| | `page_size` | query | `25` | | `filters.must[0].name` | body | `metrics.cvss_metric_v31.cvss_data.attack_complexity` | | `filters.must[0].type` | body | `eq` | | `filters.must[0].value` | body | `HIGH` | ```bash curl -X POST 'https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25' \ -H 'apikey: YOUR_API_KEY' \ -H 'Accept: application/json' \ -H 'Content-Type: application/json' \ -d '{ "filters": { "must": [ { "name": "metrics.cvss_metric_v31.cvss_data.attack_complexity", "type": "eq", "value": "HIGH" } ] } }' ``` ## Response ### 200 · OK > Shortened for this page: results: 3 of 25 shown; results[].references: first 10 items; results[].enrichment.cwe[].capec_id: first 10 items `Content-Type: application/json` · `ratelimit-limit: 1` · `ratelimit-remaining: 0` · `ratelimit-reset: 1` · `x-ratelimit-limit-second: 1` · `x-ratelimit-remaining-second: 0` · `deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a` ```json { "page": 1, "page_size": 25, "result_count": 25535, "results": [ { "id": "CVE-2026-8982", "source_identifier": "user@cyberdanube.com", "published": "2026-07-21T21:16:54Z", "last_modified": "2026-08-12T15:23:46Z", "status": "Analyzed", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "Two undocumented privileged accounts exist in Autel Maxi Charger Single firmware through V1.03.51. The accounts use vendor-defined password derivation mechanisms based on device-specific values, allowing an attacker with knowledge of the algorithm and required inputs to authenticate to the web management interface with administrative privileges." } ], "references": [ { "url": "https://cyberdanube.com/security-research/multiple-vulnerabilities-in-autel-maxi-charger/", "source": "user@cyberdanube.com", "tags": [ "Exploit", "Third Party Advisory" ] } ], "metrics": { "cvss_metric_v40": [ { "source": "user@cyberdanube.com", "type": "Secondary", "cvss_data": { "version": "4.0", "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": "NONE", "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": null, "vulnerable_system_integrity": null, "vulnerable_system_availability": null, "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": "NOT_DEFINED", "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": "NOT_DEFINED", "modified_attack_complexity": "NOT_DEFINED", "modified_attack_requirements": "NOT_DEFINED", "modified_privileges_required": "NOT_DEFINED", "modified_user_interaction": "NOT_DEFINED", "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": "NOT_DEFINED", "vulnerability_response_effort": "NOT_DEFINED", "provider_urgency": "NOT_DEFINED", "base_score": 10.0, "base_severity": "CRITICAL" } } ], "cvss_metric_v31": [ { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "HIGH", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "UNCHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 8.1, "base_severity": "HIGH", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 2.2, "impact_score": 5.9 } ], "cvss_metric_v30": null, "cvss_metric_v2": null }, "weaknesses": [ { "source": "user@cyberdanube.com", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-798" } ] } ], "configurations": [ { "operator": "AND", "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:o:autel:maxicharger_single_charger_firmware:*:*:*:*:*:*:*:american_standard", "match_criteria_id": "D41DC0CB-0C3C-4FC7-9EB1-FA708DB6ACB8", "version_start_including": null, "version_start_excluding": null, "version_end_including": "1.03.51", "version_end_excluding": null }, { "vulnerable": true, "criteria": "cpe:2.3:o:autel:maxicharger_single_charger_firmware:*:*:*:*:*:*:*:european_standard", "match_criteria_id": "7F7C8F4C-1085-4D08-8A7D-6EFA75B66C58", "version_start_including": null, "version_start_excluding": null, "version_end_including": "1.03.51", "version_end_excluding": null } ] }, { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": false, "criteria": "cpe:2.3:h:autel:maxicharger_single_charger:-:*:*:*:*:*:*:*", "match_criteria_id": "0E6B2074-D4A6-424F-B7C5-40A0FE5C17F8", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:o:autel:maxicharger_single_charger_firmware:*:*:*:*:*:*:*:american_standard", "vendor": "autel", "product": "maxicharger_single_charger_firmware", "product_type": "o", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": "1.03.51", "version_end_excluding": null, "affected_versions_first": null, "affected_versions_last": null }, { "criteria": "cpe:2.3:o:autel:maxicharger_single_charger_firmware:*:*:*:*:*:*:*:european_standard", "vendor": "autel", "product": "maxicharger_single_charger_firmware", "product_type": "o", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": "1.03.51", "version_end_excluding": null, "affected_versions_first": null, "affected_versions_last": null }, { "criteria": "cpe:2.3:h:autel:maxicharger_single_charger:-:*:*:*:*:*:*:*", "vendor": "autel", "product": "maxicharger_single_charger", "product_type": "h", "vulnerable": false, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": null, "affected_versions_last": null } ], "cwe": [ { "id": 798, "owasptop10_2021": "A07 Identification and Authentication Failures", "name": "Use of Hard-coded Credentials", "description": "The product contains hard-coded credentials, such as a password or cryptographic key.", "capec_id": [ 70, 191 ], "scope": [ "Access Control", "Availability", "Confidentiality", "Integrity", "Other" ], "impact": [ "Bypass Protection Mechanism", "Execute Unauthorized Code or Commands", "Gain Privileges or Assume Identity", "Other", "Read Application Data" ], "detection_method": [ "Architecture or Design Review", "Automated Static Analysis", "Automated Static Analysis - Binary or Bytecode", "Automated Static Analysis - Source Code", "Black Box", "Dynamic Analysis with Manual Results Interpretation", "Manual Dynamic Analysis", "Manual Static Analysis", "Manual Static Analysis - Binary or Bytecode", "Manual Static Analysis - Source Code" ] } ], "epss_score": { "epss": 0.00384, "percentile": 0.32204, "date": "2026-09-21" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "4.0", "3.1" ], "source": "user@cyberdanube.com", "type": "Secondary", "cvss_data": { "version": "4.0", "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": "NONE", "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": null, "vulnerable_system_integrity": null, "vulnerable_system_availability": null, "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": "NOT_DEFINED", "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": "NOT_DEFINED", "modified_attack_complexity": "NOT_DEFINED", "modified_attack_requirements": "NOT_DEFINED", "modified_privileges_required": "NOT_DEFINED", "modified_user_interaction": "NOT_DEFINED", "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": "NOT_DEFINED", "vulnerability_response_effort": "NOT_DEFINED", "provider_urgency": "NOT_DEFINED", "base_score": 10.0, "base_severity": "CRITICAL" } } } }, { "id": "CVE-2026-62836", "source_identifier": "user@microsoft.com", "published": "2026-08-07T00:16:34Z", "last_modified": "2026-08-12T05:18:52Z", "status": "Analyzed", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauthorized attacker to elevate privileges over a network." } ], "references": [ { "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62836", "source": "user@microsoft.com", "tags": [ "Vendor Advisory" ] } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "user@microsoft.com", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "attack_vector": "NETWORK", "attack_complexity": "HIGH", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "NONE", "base_score": 8.7, "base_severity": "HIGH", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 2.2, "impact_score": 5.8 }, { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "NONE", "base_score": 10.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 5.8 } ], "cvss_metric_v30": null, "cvss_metric_v2": null }, "weaknesses": [ { "source": "user@microsoft.com", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-923" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:microsoft:azure_sql_managed_instance:-:*:*:*:*:*:*:*", "match_criteria_id": "A02C25B8-26C6-4E93-98AA-C3BE4F7E7492", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:microsoft:azure_sql_managed_instance:-:*:*:*:*:*:*:*", "vendor": "microsoft", "product": "azure_sql_managed_instance", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": null, "affected_versions_last": null } ], "cwe": [ { "id": 923, "owasptop10_2021": null, "name": "Improper Restriction of Communication Channel to Intended Endpoints", "description": "The product establishes a communication channel to (or from) an endpoint for privileged or protected operations, but it does not properly ensure that it is communicating with the correct endpoint.", "capec_id": [ 161, 481, 501, 697 ], "scope": [ "Confidentiality", "Integrity" ], "impact": [ "Gain Privileges or Assume Identity" ], "detection_method": [ "Automated Static Analysis" ] } ], "epss_score": { "epss": 0.00435, "percentile": 0.3727, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.1" ], "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "NONE", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 10.0, "base_severity": "CRITICAL" } } } }, { "id": "CVE-2026-47691", "source_identifier": "user@github.com", "published": "2026-06-12T16:16:30Z", "last_modified": "2026-09-18T13:18:28Z", "status": "Modified", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "Netty is a network application framework for development of protocol servers and clients. Prior to versions 4.1.135.Final and 4.2.15.Final, Netty's `DnsResolveContext` insufficiently validates the bailiwick of NS records, enabling DNS Cache Poisoning. An attacker controlling an authoritative name server for a subdomain can poison the cache for parent domains (like `.co.uk`). In `io.netty.resolver.dns.DnsResolveContext.AuthoritativeNameServerList#add` method accepts any NS record from the AUTHORITY section as long as the record's name is a suffix of the questionName. Subsequently, the `handleWithAdditional` method caches the associated A records from the ADDITIONAL section directly into the `authoritativeDnsServerCache` under the parent domain's key. This bypasses standard bailiwick rules, where a server authoritative for a subdomain should not be trusted to provide authoritative records for its parent. The poisoned cache is then used for all future resolutions under the parent domain's key. Versions 4.1.135.Final and 4.2.15.Final patch the issue." } ], "references": [ { "url": "https://github.com/netty/netty/releases/tag/netty-4.1.135.Final", "source": "user@github.com", "tags": [ "Release Notes" ] }, { "url": "https://github.com/netty/netty/releases/tag/netty-4.2.15.Final", "source": "user@github.com", "tags": [ "Release Notes" ] }, { "url": "https://github.com/netty/netty/security/advisories/GHSA-5pvg-856g-cp85", "source": "user@github.com", "tags": [ "Vendor Advisory" ] }, { "url": "https://access.redhat.com/errata/RHSA-2026:26017", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "tags": null }, { "url": "https://access.redhat.com/errata/RHSA-2026:26018", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "tags": null }, { "url": "https://access.redhat.com/errata/RHSA-2026:26586", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "tags": null }, { "url": "https://access.redhat.com/errata/RHSA-2026:34608", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "tags": null }, { "url": "https://access.redhat.com/errata/RHSA-2026:37390", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "tags": null }, { "url": "https://access.redhat.com/errata/RHSA-2026:41951", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "tags": null }, { "url": "https://access.redhat.com/errata/RHSA-2026:48151", "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "tags": null } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "user@github.com", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "attack_vector": "NETWORK", "attack_complexity": "HIGH", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "NONE", "base_score": 8.7, "base_severity": "HIGH", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 2.2, "impact_score": 5.8 }, { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "NONE", "base_score": 10.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 5.8 }, { "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N", "attack_vector": "NETWORK", "attack_complexity": "HIGH", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "NONE", "base_score": 8.7, "base_severity": "HIGH", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 2.2, "impact_score": 5.8 } ], "cvss_metric_v30": null, "cvss_metric_v2": null }, "weaknesses": [ { "source": "user@github.com", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-345" } ] }, { "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-346" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*", "match_criteria_id": "3097D962-A32D-4467-AAE7-F4CBA3A349D2", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "4.1.135" }, { "vulnerable": true, "criteria": "cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*", "match_criteria_id": "413D4611-A46C-4BE4-AB2F-D86282F65984", "version_start_including": "4.2.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "4.2.15" } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*", "vendor": "netty", "product": "netty", "product_type": "a", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "4.1.135", "affected_versions_first": "3.2.4", "affected_versions_last": "4.1.134" }, { "criteria": "cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*", "vendor": "netty", "product": "netty", "product_type": "a", "vulnerable": true, "version_start_including": "4.2.0", "version_start_excluding": null, "version_end_including": null, "version_end_excluding": "4.2.15", "affected_versions_first": "4.2.0", "affected_versions_last": "4.2.14" } ], "cwe": [ { "id": 345, "owasptop10_2021": "A08 Software and Data Integrity Failures", "name": "Insufficient Verification of Data Authenticity", "description": "The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.", "capec_id": [ 111, 141, 142, 148, 218, 384, 385, 386, 387, 388 ], "scope": [ "Integrity", "Other" ], "impact": [ "Unexpected State", "Varies by Context" ], "detection_method": [ "Automated Static Analysis" ] }, { "id": 346, "owasptop10_2021": "A07 Identification and Authentication Failures", "name": "Origin Validation Error", "description": "The product does not properly verify that the source of data or communication is valid.", "capec_id": [ 21, 59, 60, 75, 76, 89, 111, 141, 142, 160 ], "scope": [ "Access Control", "Other" ], "impact": [ "Gain Privileges or Assume Identity", "Varies by Context" ], "detection_method": [ "Automated Static Analysis" ] } ], "epss_score": { "epss": 0.00386, "percentile": 0.32578, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.1" ], "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "NONE", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 10.0, "base_severity": "CRITICAL" } } } } ] } ``` ## Related Examples - [CVSS v3.1: Local Attack Vector](/reference/vulnerability/search/examples/metrics-cvss-metric-v31-cvss-data-attack-vector/) - [CVSS v3.1: Low Privileges Required](/reference/vulnerability/search/examples/metrics-cvss-metric-v31-cvss-data-privileges-required/) - [CVSS v3.1: The Log4Shell Vector](/reference/vulnerability/search/examples/metrics-cvss-metric-v31-cvss-data-vector-string/) - [CVSS v3.1: User Interaction Required](/reference/vulnerability/search/examples/metrics-cvss-metric-v31-cvss-data-user-interaction/) - [CVSS v3.1: Any Score](/reference/vulnerability/search/examples/metrics-cvss-metric-v31-cvss-data-version/) - [CVSS v3.1: Unchanged Scope](/reference/vulnerability/search/examples/metrics-cvss-metric-v31-cvss-data-scope/)