# CVSS v3.1: Hard to Exploit CVEs whose CVSS v3.1 exploitability sub-score is 1.0 or lower. Source: https://docs.deepinfo.com/reference/vulnerability/search/examples/metrics-cvss-metric-v31-exploitability-score/ Last updated: 2026-09-26 --- `POST https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25` CVEs whose CVSS v3.1 exploitability sub-score is 1.0 or lower. Example 15 of 16 in **Filters › CVSS v3.1** · [Vulnerability Search Examples](/reference/vulnerability/search/examples/) · endpoint: [Search](/reference/vulnerability/search/) Tags: `field` `metrics.cvss_metric_v31.exploitability_score` · `operator` `lte` `metrics.cvss_metric_v31.exploitability_score` is the exploitability sub-score, in the CVSS v3.1 metric (`metrics.cvss_metric_v31`, one entry per scoring source). `lte` matches `1` and below. In the response, look at `results[].metrics.cvss_metric_v31[].exploitability_score`. ## Request | Parameter | In | Value | |---|---|---| | `page_size` | query | `25` | | `filters.must[0].name` | body | `metrics.cvss_metric_v31.exploitability_score` | | `filters.must[0].type` | body | `lte` | | `filters.must[0].value` | body | `1` | ```bash curl -X POST 'https://api.deepinfo.com/v1/discovery/vulnerability-search?page_size=25' \ -H 'apikey: YOUR_API_KEY' \ -H 'Accept: application/json' \ -H 'Content-Type: application/json' \ -d '{ "filters": { "must": [ { "name": "metrics.cvss_metric_v31.exploitability_score", "type": "lte", "value": 1 } ] } }' ``` ## Response ### 200 · OK > Shortened for this page: results: 3 of 25 shown; results[].configurations[].nodes[].cpe_match: first 10 items; results[].enrichment.cpe: first 10 items; results[].enrichment.cwe[].capec_id: first 10 items `Content-Type: application/json` · `ratelimit-limit: 1` · `ratelimit-remaining: 0` · `ratelimit-reset: 1` · `x-ratelimit-limit-second: 1` · `x-ratelimit-remaining-second: 0` · `deepinfo-request-id: 5f0c6a8e-1b2d-4c3e-9f4a-7b8c9d0e1f2a` ```json { "page": 1, "page_size": 25, "result_count": 14673, "results": [ { "id": "CVE-2026-0083", "source_identifier": "user@android.com", "published": "2026-06-17T13:19:26Z", "last_modified": "2026-06-18T04:16:33Z", "status": "Analyzed", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "In Nfc::eventCallback() of Nfc.h, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation." } ], "references": [ { "url": "https://source.android.com/docs/security/bulletin/android-17", "source": "user@android.com", "tags": [ "Vendor Advisory" ] } ], "metrics": { "cvss_metric_v40": [ { "source": "user@android.com", "type": "Secondary", "cvss_data": { "version": "4.0", "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": "NONE", "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": null, "vulnerable_system_integrity": null, "vulnerable_system_availability": null, "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": "NOT_DEFINED", "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": "NOT_DEFINED", "modified_attack_complexity": "NOT_DEFINED", "modified_attack_requirements": "NOT_DEFINED", "modified_privileges_required": "NOT_DEFINED", "modified_user_interaction": "NOT_DEFINED", "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": "NOT_DEFINED", "vulnerability_response_effort": "NOT_DEFINED", "provider_urgency": "NOT_DEFINED", "base_score": 10.0, "base_severity": "CRITICAL" } } ], "cvss_metric_v31": [ { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "LOCAL", "attack_complexity": "HIGH", "privileges_required": "LOW", "user_interaction": "NONE", "scope": "UNCHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 7.0, "base_severity": "HIGH", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 1.0, "impact_score": 5.9 } ], "cvss_metric_v30": null, "cvss_metric_v2": null }, "weaknesses": [ { "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-362" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:o:google:android:17.0:-:*:*:*:*:*:*", "match_criteria_id": "E3D15FD9-304E-4270-81C7-C8D9024D457D", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:o:google:android:17.0:-:*:*:*:*:*:*", "vendor": "google", "product": "android", "product_type": "o", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": "17.0", "affected_versions_last": "17.0" } ], "cwe": [ { "id": 362, "owasptop10_2021": null, "name": "Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "description": "The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.", "capec_id": [ 26, 29 ], "scope": [ "Access Control", "Availability", "Confidentiality", "Integrity" ], "impact": [ "Bypass Protection Mechanism", "DoS: Crash, Exit, or Restart", "DoS: Instability", "DoS: Resource Consumption (CPU)", "DoS: Resource Consumption (Memory)", "DoS: Resource Consumption (Other)", "Execute Unauthorized Code or Commands", "Gain Privileges or Assume Identity", "Read Application Data", "Read Files or Directories" ], "detection_method": [ "Architecture or Design Review", "Automated Dynamic Analysis", "Automated Static Analysis - Binary or Bytecode", "Automated Static Analysis - Source Code", "Black Box", "Dynamic Analysis with Automated Results Interpretation", "Dynamic Analysis with Manual Results Interpretation", "Manual Static Analysis - Source Code", "White Box" ] } ], "epss_score": { "epss": 0.00121, "percentile": 0.02151, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "4.0", "3.1" ], "source": "user@android.com", "type": "Secondary", "cvss_data": { "version": "4.0", "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": "NONE", "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": null, "vulnerable_system_integrity": null, "vulnerable_system_availability": null, "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": "NOT_DEFINED", "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": "NOT_DEFINED", "modified_attack_complexity": "NOT_DEFINED", "modified_attack_requirements": "NOT_DEFINED", "modified_privileges_required": "NOT_DEFINED", "modified_user_interaction": "NOT_DEFINED", "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": "NOT_DEFINED", "vulnerability_response_effort": "NOT_DEFINED", "provider_urgency": "NOT_DEFINED", "base_score": 10.0, "base_severity": "CRITICAL" } } } }, { "id": "CVE-2022-3703", "source_identifier": "user@hq.dhs.gov", "published": "2022-11-10T22:15:14Z", "last_modified": "2026-06-17T05:00:08Z", "status": "Modified", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "All versions of ETIC Telecom Remote Access Server (RAS) 4.5.0 and prior’s web portal is vulnerable to accepting malicious firmware packages that could provide a backdoor to an attacker and provide privilege escalation to the device." }, { "lang": "es", "value": "Todas las versiones de ETIC Telecom Remote Access Server (RAS) 4.5.0 y el portal web anterior son vulnerables a aceptar paquetes de firmware maliciosos que podrían proporcionar backdoor a un atacante y proporcionar una escalada de privilegios al dispositivo." } ], "references": [ { "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-307-01", "source": "user@hq.dhs.gov", "tags": [ "Patch", "Third Party Advisory", "US Government Resource" ] }, { "url": "https://www.cisa.gov/uscert/ics/advisories/icsa-22-307-01", "source": "af854a3a-2127-422b-91ae-364da2661108", "tags": [ "Patch", "Third Party Advisory", "US Government Resource" ] } ], "metrics": { "cvss_metric_v40": null, "cvss_metric_v31": [ { "source": "user@hq.dhs.gov", "type": "Secondary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "ADJACENT_NETWORK", "attack_complexity": "HIGH", "privileges_required": "HIGH", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 7.6, "base_severity": "HIGH", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 1.0, "impact_score": 6.0 }, { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "privileges_required": "NONE", "user_interaction": "NONE", "scope": "CHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 10.0, "base_severity": "CRITICAL", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 3.9, "impact_score": 6.0 } ], "cvss_metric_v30": null, "cvss_metric_v2": null }, "weaknesses": [ { "source": "user@hq.dhs.gov", "type": "Secondary", "description": [ { "lang": "en", "value": "CWE-345" } ] } ], "configurations": [ { "operator": "AND", "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:o:etictelecom:remote_access_server_firmware:*:*:*:*:*:*:*:*", "match_criteria_id": "7AE4F7CD-BE37-40B5-9A53-39B42CD17EF5", "version_start_including": null, "version_start_excluding": null, "version_end_including": "4.5.0", "version_end_excluding": null } ] }, { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": false, "criteria": "cpe:2.3:h:etictelecom:ras-c-100-lw:-:*:*:*:*:*:*:*", "match_criteria_id": "5DAE45DD-78EE-4ACB-A1E5-C190BE642BDF", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:etictelecom:ras-e-100:-:*:*:*:*:*:*:*", "match_criteria_id": "93F02AE2-6AC3-492E-9E91-E9F0725A1EEB", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:etictelecom:ras-e-220:-:*:*:*:*:*:*:*", "match_criteria_id": "C32ED13F-237B-441C-8032-F54615AEFC73", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:etictelecom:ras-e-400:-:*:*:*:*:*:*:*", "match_criteria_id": "86536932-B27A-4028-829D-2924CD431C54", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:etictelecom:ras-ec-220-lw:-:*:*:*:*:*:*:*", "match_criteria_id": "52E2D325-0AE3-4459-9F27-5CC19349F060", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:etictelecom:ras-ec-400-lw:-:*:*:*:*:*:*:*", "match_criteria_id": "DB8D1AA9-42C0-4546-A02E-91B3D7A8AD4B", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:etictelecom:ras-ec-480-lw:-:*:*:*:*:*:*:*", "match_criteria_id": "50EEA797-3218-44FE-8D93-178C40F4BF17", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:etictelecom:ras-ecw-220-lw:-:*:*:*:*:*:*:*", "match_criteria_id": "E768A79E-BBFD-47C1-8535-1F721D92575C", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:etictelecom:ras-ecw-400-lw:-:*:*:*:*:*:*:*", "match_criteria_id": "F1D86798-3C5F-40A9-BF41-0602F78A027B", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null }, { "vulnerable": false, "criteria": "cpe:2.3:h:etictelecom:ras-ew-100:-:*:*:*:*:*:*:*", "match_criteria_id": "D12CC48E-6DAC-4412-9068-04B774540500", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:o:etictelecom:remote_access_server_firmware:*:*:*:*:*:*:*:*", "vendor": "etictelecom", "product": "remote_access_server_firmware", "product_type": "o", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": "4.5.0", "version_end_excluding": null, "affected_versions_first": "4.5.0", "affected_versions_last": "4.5.0" }, { "criteria": "cpe:2.3:h:etictelecom:ras-c-100-lw:-:*:*:*:*:*:*:*", "vendor": "etictelecom", "product": "ras-c-100-lw", "product_type": "h", "vulnerable": false, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": null, "affected_versions_last": null }, { "criteria": "cpe:2.3:h:etictelecom:ras-e-100:-:*:*:*:*:*:*:*", "vendor": "etictelecom", "product": "ras-e-100", "product_type": "h", "vulnerable": false, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": null, "affected_versions_last": null }, { "criteria": "cpe:2.3:h:etictelecom:ras-e-220:-:*:*:*:*:*:*:*", "vendor": "etictelecom", "product": "ras-e-220", "product_type": "h", "vulnerable": false, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": null, "affected_versions_last": null }, { "criteria": "cpe:2.3:h:etictelecom:ras-e-400:-:*:*:*:*:*:*:*", "vendor": "etictelecom", "product": "ras-e-400", "product_type": "h", "vulnerable": false, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": null, "affected_versions_last": null }, { "criteria": "cpe:2.3:h:etictelecom:ras-ec-220-lw:-:*:*:*:*:*:*:*", "vendor": "etictelecom", "product": "ras-ec-220-lw", "product_type": "h", "vulnerable": false, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": null, "affected_versions_last": null }, { "criteria": "cpe:2.3:h:etictelecom:ras-ec-400-lw:-:*:*:*:*:*:*:*", "vendor": "etictelecom", "product": "ras-ec-400-lw", "product_type": "h", "vulnerable": false, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": null, "affected_versions_last": null }, { "criteria": "cpe:2.3:h:etictelecom:ras-ec-480-lw:-:*:*:*:*:*:*:*", "vendor": "etictelecom", "product": "ras-ec-480-lw", "product_type": "h", "vulnerable": false, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": null, "affected_versions_last": null }, { "criteria": "cpe:2.3:h:etictelecom:ras-ecw-220-lw:-:*:*:*:*:*:*:*", "vendor": "etictelecom", "product": "ras-ecw-220-lw", "product_type": "h", "vulnerable": false, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": null, "affected_versions_last": null }, { "criteria": "cpe:2.3:h:etictelecom:ras-ecw-400-lw:-:*:*:*:*:*:*:*", "vendor": "etictelecom", "product": "ras-ecw-400-lw", "product_type": "h", "vulnerable": false, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": null, "affected_versions_last": null } ], "cwe": [ { "id": 345, "owasptop10_2021": "A08 Software and Data Integrity Failures", "name": "Insufficient Verification of Data Authenticity", "description": "The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.", "capec_id": [ 111, 141, 142, 148, 218, 384, 385, 386, 387, 388 ], "scope": [ "Integrity", "Other" ], "impact": [ "Unexpected State", "Varies by Context" ], "detection_method": [ "Automated Static Analysis" ] } ], "epss_score": { "epss": 0.00308, "percentile": 0.23856, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "3.1" ], "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": null, "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": "HIGH", "vulnerable_system_integrity": "HIGH", "vulnerable_system_availability": "HIGH", "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": null, "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_attack_requirements": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": null, "vulnerability_response_effort": null, "provider_urgency": null, "base_score": 10.0, "base_severity": "CRITICAL" } } } }, { "id": "CVE-2018-9416", "source_identifier": "user@android.com", "published": "2024-12-05T00:15:18Z", "last_modified": "2026-06-17T02:06:37Z", "status": "Analyzed", "evaluator_comment": null, "evaluator_solution": null, "evaluator_impact": null, "cisa_exploit_add": null, "cisa_action_due": null, "cisa_required_action": null, "cisa_vulnerability_name": null, "descriptions": [ { "lang": "en", "value": "In sg_remove_scat of scsi/sg.c, there is a possible memory corruption due to\n an unusual root cause. This could lead to local escalation of privilege with\n System execution privileges needed. User interaction is not needed for\n exploitation." }, { "lang": "es", "value": "En sg_remove_scat de scsi/sg.c, existe una posible corrupción de memoria debido a una causa raíz inusual. Esto podría conducir a una escalada de privilegios local con privilegios de ejecución de Sistema necesarios. No se necesita interacción del usuario para la explotación." } ], "references": [ { "url": "https://source.android.com/security/bulletin/pixel/2018-07-01", "source": "user@android.com", "tags": [ "Vendor Advisory" ] } ], "metrics": { "cvss_metric_v40": [ { "source": "user@android.com", "type": "Secondary", "cvss_data": { "version": "4.0", "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": "NONE", "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": null, "vulnerable_system_integrity": null, "vulnerable_system_availability": null, "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": "NOT_DEFINED", "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": "NOT_DEFINED", "modified_attack_complexity": "NOT_DEFINED", "modified_attack_requirements": "NOT_DEFINED", "modified_privileges_required": "NOT_DEFINED", "modified_user_interaction": "NOT_DEFINED", "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": "NOT_DEFINED", "vulnerability_response_effort": "NOT_DEFINED", "provider_urgency": "NOT_DEFINED", "base_score": 10.0, "base_severity": "CRITICAL" } } ], "cvss_metric_v31": [ { "source": "user@nist.gov", "type": "Primary", "cvss_data": { "version": "3.1", "vector_string": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "attack_vector": "LOCAL", "attack_complexity": "LOW", "privileges_required": "HIGH", "user_interaction": "NONE", "scope": "UNCHANGED", "confidentiality_impact": "HIGH", "integrity_impact": "HIGH", "availability_impact": "HIGH", "base_score": 6.7, "base_severity": "MEDIUM", "exploit_code_maturity": null, "remediation_level": null, "report_confidence": null, "temporal_score": null, "temporal_severity": null, "confidentiality_requirement": null, "integrity_requirement": null, "availability_requirement": null, "modified_attack_vector": null, "modified_attack_complexity": null, "modified_privileges_required": null, "modified_user_interaction": null, "modified_scope": null, "modified_confidentiality_impact": null, "modified_integrity_impact": null, "modified_availability_impact": null, "environmental_score": null, "environmental_severity": null }, "exploitability_score": 0.8, "impact_score": 5.9 } ], "cvss_metric_v30": null, "cvss_metric_v2": null }, "weaknesses": [ { "source": "user@nist.gov", "type": "Primary", "description": [ { "lang": "en", "value": "CWE-787" } ] } ], "configurations": [ { "operator": null, "negate": null, "nodes": [ { "operator": "OR", "negate": false, "cpe_match": [ { "vulnerable": true, "criteria": "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*", "match_criteria_id": "F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26", "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null } ] } ] } ], "vendor_comments": null, "enrichment": { "cpe": [ { "criteria": "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*", "vendor": "google", "product": "android", "product_type": "o", "vulnerable": true, "version_start_including": null, "version_start_excluding": null, "version_end_including": null, "version_end_excluding": null, "affected_versions_first": null, "affected_versions_last": null } ], "cwe": [ { "id": 787, "owasptop10_2021": null, "name": "Out-of-bounds Write", "description": "The product writes data past the end, or before the beginning, of the intended buffer.", "capec_id": null, "scope": [ "Availability", "Integrity", "Other" ], "impact": [ "DoS: Crash, Exit, or Restart", "Execute Unauthorized Code or Commands", "Modify Memory", "Unexpected State" ], "detection_method": [ "Automated Dynamic Analysis", "Automated Static Analysis" ] } ], "epss_score": { "epss": 0.00164, "percentile": 0.06006, "date": "2026-09-23" }, "cisa_kev": null, "vdeep_metric": { "available_versions": [ "4.0", "3.1" ], "source": "user@android.com", "type": "Secondary", "cvss_data": { "version": "4.0", "vector_string": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "attack_vector": "NETWORK", "attack_complexity": "LOW", "attack_requirements": "NONE", "privileges_required": "NONE", "user_interaction": "NONE", "vulnerable_system_confidentiality": null, "vulnerable_system_integrity": null, "vulnerable_system_availability": null, "subsequent_system_confidentiality": null, "subsequent_system_integrity": null, "subsequent_system_availability": null, "exploit_maturity": "NOT_DEFINED", "confidentiality_requirements": null, "integrity_requirements": null, "availability_requirements": null, "modified_attack_vector": "NOT_DEFINED", "modified_attack_complexity": "NOT_DEFINED", "modified_attack_requirements": "NOT_DEFINED", "modified_privileges_required": "NOT_DEFINED", "modified_user_interaction": "NOT_DEFINED", "modified_vulnerable_system_confidentiality": null, "modified_vulnerable_system_integrity": null, "modified_vulnerable_system_availability": null, "modified_subsequent_system_confidentiality": null, "modified_subsequent_system_integrity": null, "modified_subsequent_system_availability": null, "safety": null, "automatable": null, "recovery": null, "value_density": "NOT_DEFINED", "vulnerability_response_effort": "NOT_DEFINED", "provider_urgency": "NOT_DEFINED", "base_score": 10.0, "base_severity": "CRITICAL" } } } } ] } ``` ## Related Examples - [CVSS 4.0: Base Score 9.0 to 9.9](/reference/vulnerability/search/examples/metrics-cvss-metric-v40-cvss-data-base-score/) - [CVSS v3.0: Low Impact Score](/reference/vulnerability/search/examples/metrics-cvss-metric-v30-impact-score/) - [CVSS v2: Low Impact Score](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-impact-score/) - [CVSS v2: Low Exploitability Score](/reference/vulnerability/search/examples/metrics-cvss-metric-v2-exploitability-score/) - [KEV Remediation Due in November 2021](/reference/vulnerability/search/examples/cisa-action-due/) - [EPSS Scores Dated 22 September 2026 or Earlier](/reference/vulnerability/search/examples/enrichment-epss-score-date/)