CVEs and CVSS
Turn a version banner into a known exploit, and score how bad it really is.
What you will learn
- -Read a CVE advisory and pull out the parts that matter
- -Interpret a CVSS score and vector string
- -Match a service version to a public exploit
Your scan just told you a box runs vsftpd 2.3.4. That string is a gift. Every
public in that exact version already has a name, a write-up, and
often working code. Learning to go from a version banner to a known
weakness is the daily reality of exploitation.
What a CVE actually is
A CVE (Common Vulnerabilities and Exposures) is a unique ID for one specific
publicly known flaw, like CVE-2021-44228 (Log4Shell). It is not the exploit
and not the patch. It is a stable label so everyone (vendors, scanners,
attackers) is talking about the same bug.
An advisory tied to a CVE tells you the things you care about:
- Affected versions: the exact range of software that is vulnerable.
- Vulnerability type: RCE, auth bypass, , and so on.
- Attack vector: is it -reachable, or does it need local access?
- References: links to the write-up and, often, proof-of-concept code.
The first question on any advisory is always the same. Does the version in front
of me fall inside the affected range? A bug in 1.4.0 through 1.4.7 does nothing
for you if the target runs 1.5.0.
Reading a CVSS score
CVSS (Common Vulnerability Scoring ) puts a 0.0 to 10.0 number on severity. Rough bands: 0.1 to 3.9 low, 4.0 to 6.9 medium, 7.0 to 8.9 high, 9.0 to 10.0 critical. The number alone is a tool, not the whole story.
The vector string underneath the number is where the real detail lives:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- AV:N Attack Vector is Network. You can hit it remotely.
- AC:L Attack Complexity is Low. No special conditions needed.
- PR:N Privileges Required is None. You do not need an account.
- UI:N User Interaction is None. No victim has to click anything.
- C:H/I:H/A:H full on Confidentiality, Integrity, Availability.
That combination (remote, easy, unauthenticated, full impact) is the profile of a bug you drop everything to test.
A 9.8 that needs a rare non-default config may be harder to land than a 7.5 on an internet-facing login page. Read the vector, not just the number, and always confirm the exact version before you spend time on an exploit.
From version to exploit on your box
Once you have a version, search the local exploit database that ships with Kali:
$searchsploit vsftpd 2.3.4$searchsploit -x unix/remote/17491.rb$nmap -sV --script vuln 10.10.14.23Never fire an exploit you have not read. Random PoC code can be sloppy, backdoored, or destructive. Open it, understand what it sends, and confirm it targets your scoped before you touch it.
A CVSS vector shows AV:N, PR:N, UI:N. What does that tell you?
An advisory lists affected versions '2.4.0 through 2.4.9'. Your target banner says 2.4.10. Is it vulnerable to this CVE? Answer yes or no.
The affected range stops at 2.4.9. Version 2.4.10 falls outside it, so this particular CVE does not apply. Always match the exact version.