CVSS v3.1 Score Calculator
Eight CVSS metrics to base score and vector.
What it does
CVSS turns vulnerability traits into one comparable number from 0 to 10. Exploitability meets impact through standard weights, scope reshapes the curve, and rounding always climbs. Teams triage by it daily.
The tool above implements the FIRST v3.1 base equations with reference Roundup: pick all eight metrics and read score, severity band, and the vector string. Published CVE vectors reproduce exactly.
FIRST owns the open standard with NVD publishing scores beside disclosures. The base group stays constant across environments; temporal and environmental groups tune it per deployment. Vectors travel with scores so anyone can audit the math.
Score honestly and patch by band plus asset value. A 7.5 on an Internet edge box outranks a 9.8 buried in an isolated lab. Base scores start prioritization; context finishes it.
How to use
- Pick the four exploitability metrics.
- Pick scope unchanged or changed.
- Pick confidentiality, integrity, availability.
- Read base score and severity.
- Copy the vector string with the score.
- Add temporal scores per deployment.
Formula
- AV
- Attack Vector: N 0.85, A 0.62, L 0.55, P 0.2.
- AC
- Attack Complexity: L 0.77, H 0.44.
- PR
- Privileges: N 0.85, L 0.62/0.68, H 0.27/0.5.
- S
- Scope unchanged or changed.
Scope-unchanged Impact is 6.42 x ISS; changed uses 7.52 x (ISS-0.029) minus 3.25 x (ISS-0.02)^15. Privileges values shift under changed scope (low 0.68, high 0.5). Roundup follows the reference ceil-to-tenth.
Worked example
Example: 8.1 High vector
Network, high complexity, no privileges or interaction, full CIA loss.
- Vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
- ISS: 1 - 0.44^3 = 0.9148.
- Impact: 6.42 x 0.9148 = 5.873.
- Exploit: 8.22 x 0.85 x 0.44 x 0.85 x 0.85 = 2.221.
- Base: Roundup(8.094) = 8.1 High.
Reference table
| Band | Score | Move |
|---|---|---|
| None | 0.0 | No action |
| Low | 0.1 to 3.9 | Routine patches |
| Medium | 4.0 to 6.9 | Scheduled fixes |
| High | 7.0 to 8.9 | Priority fixes |
| Critical | 9.0 to 10.0 | Emergency change |
Limits
- Base only. Temporal and environmental tune reality.
- Analyst judgment picks metrics; garbage in, garbage out.
- Bands prioritize, never decide alone.
- Spec version matters; v4 differs.
Common mistakes
- Scoring without reading metric definitions.
- Forgetting scope changes the math.
- Rounding normally instead of Roundup.
- Publishing scores without vectors.
- Treating 9.8 on lab gear as urgent.
Try it yourself
Quick checks. Answers sit tucked under each question.
Score for AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N?
ISS is 0.56, impact 3.595, exploit 3.887. Base Roundup(7.48) = 7.5 High.
Score with C:N/I:N/A:N?
No impact means ISS 0 and impact 0, so Base is 0.0 None.
Questions
What do the attack vectors mean?
Network, Adjacent, Local, Physical in that severity order. Remote Internet-exposed flaws outrank ones needing hands on the box.
What is scope changed vs unchanged?
Whether the break crosses a trust boundary into another authority. Changed scope raises and reshapes the math with the 1.08 factor and different impact curve.
How does CVSS rounding work?
Roundup to one decimal always up: 4.02 becomes 4.1 while 4.00 stays 4.0. The engine mirrors the reference rounding exactly.
What are the severity bands?
None 0.0, Low 0.1-3.9, Medium 4.0-6.9, High 7.0-8.9, Critical 9.0-10.0. Bands prioritize; they never replace context like asset value.
Do known CVEs verify this page?
Yes: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N scores 7.5 High, matching published Heartbleed data. All-none scores 0.0 None.
Where are temporal and environmental scores?
Base only here. Temporal (exploit maturity, fixes) and Environmental (asset value, mitigations) adjust scores per deployment in the full standard.