CVSS 4.0: What Medical Device Manufacturers Need to Know
November 1, 2023, marked the release of CVSS 4.0 (Common Vulnerability Scoring System), the most significant update to the framework since CVSS 3.0 was introduced in 2015. Although CVSS 3.1 was released in 2019, version 4.0 introduces substantial changes that reflect the evolution of vulnerability management practices and industry needs. With it, a cascade of improvements have been brought about demonstrating the newest advancements in industry thinking since that time. Now, some new metrics have been added, and several have been expanded in order to create a score that more accurately reflects the severity of an exploit and increase its fidelity for the public and industry professionals alike.
It is important for Medical Device Manufacturers to know that by July 2nd, 2028, the FDA plans on phasing out the old CVSS 3.1 standard and fully adopting 4.0. This new version of CVSS is not backwards compatible with the older version, and scores cannot simply be translated from one to another. Thus, in the future any medical device vulnerabilities currently known must be rescored before this window closes. This blog post will thus highlight some of the changes between versions in order to better familiarize oneself with the new scoring process.
CVSS 4.0 in the Context of Medical Device Cybersecurity
For medical device manufacturers, these improvements make CVSS 4.0 a more valuable component of a risk-based cybersecurity program rather than simply a scoring mechanism.
An SBOM provides visibility into the software components within a device, allowing manufacturers to quickly identify vulnerabilities that may affect their products. Threat modeling adds critical context by identifying how those vulnerabilities could be exploited within the device architecture and by evaluating potential impacts on patient safety, clinical operations, and data security.
When combined with the enhanced Threat and Environmental metrics in CVSS 4.0, these practices enable organizations to prioritize remediation based not only on the technical severity of a vulnerability, but also on exploitability, device deployment, existing mitigations, and the potential impact on safety and essential performance. This integrated approach aligns well with modern medical device cybersecurity guidance and supports more effective vulnerability management throughout the product lifecycle.
Key Changes in CVSS 4.0
New Metrics
One of the biggest changes from version 3.1 is the addition of several new metrics intended to complement some of the previously established ones.
The most notable of these is the Attack Requirements metric designed to augment the Attack Complexity metric. The Attack Requirements (AT) metric captures conditions outside an attacker’s control that must exist for exploitation to succeed, such as specific system configurations or environmental prerequisites. This provides additional context beyond Attack Complexity.
Furthermore, the Impact metric has been split to include information on both the vulnerable system and any subsequent system. Both new metrics serve to better differentiate risks in a more meaningful manner.
Removal of the Scope Metric
Another significant change in CVSS 4.0 is the removal of the Scope metric.
In CVSS 3.1, the scope metric was used to indicate if a vulnerability could impact resources beyond its original security scope. CVSS 4.0 now has more precise metrics that distinguish between the vulnerable system and subsequent systems.
This change makes the scoring process easier to understand while still capturing the broader impact of a vulnerability, improving consistency and reducing confusion around how it affects other systems.
Expanded User Interaction Metric
An important difference between the newer and older versions of CVSS is the expansion of the User Interaction metric into three values as opposed to simply ‘yes’ and ‘no.’
The metric now includes three values:
- None
- Passive
- Active
These values describe the degree of participation required from a user other than the attacker. This refinement is particularly useful when evaluating vulnerabilities that rely on phishing or other social engineering techniques.
This update allows CVSS to be more fine-grained in describing a vulnerability, allowing for a more realistic approach to understanding severity, especially in the case of social engineering attacks.
Introduction of Supplemental Metrics
CVSS 4.0 introduces the Supplemental Metric, which gives extra context about a vulnerability without directly affecting its base score.
This lets users include things like safety impact and how easily an exploit can be automated. These metrics are optional and provide additional context without directly influencing the score.
Overall, this metric allows organizations to share useful information without manipulating the score or making it more complicated.
Temporal Metrics Replaced by Threat Metrics
CVSS 4.0 replaces the Temporal metric group with the Threat metric group, simplifying the model and focusing specifically on the likelihood of exploitation based on available intelligence.
Thus, a CVSS score can more properly place the exploit in its proper context within the security community’s knowledge, creating a more useful and comprehensive score for the vulnerability in question overall.
How Medware Cyber Helps Medical Device Manufacturers
Medware Cyber helps medical device manufactures strengthen cybersecurity programs by supporting organizations throughout the product lifecycle. Our services help organizations improve:
- Vulnerability management processes
- Threat modeling practices
- SBOM analysis
- Cybersecurity risk assessments
- Post market cybersecurity activities
- Regulatory cybersecurity readiness
The transition to CVSS 4.0 is an opportunity for manufacturers to move beyond traditional vulnerability scoring and develop a more comprehensive understanding of cybersecurity risk.
By preparing now, organizations can improve their ability to identify, prioritize, and address vulnerabilities while supporting the safety, security, and reliability of their medical devices.
Conclusion
CVSS 4.0 represents a shift from simply assigning a severity score to providing richer context for vulnerability prioritization. By separating inherent vulnerability severity from real-world risk and introducing more precise metrics, organizations can make better-informed remediation decisions and allocate security resources more effectively.