CVSS rates how severe one vulnerability is. The EOL Risk Score rates how risky one software version is to keep running. How they differ and work together.
Side by side
| CVSS | EOL Risk Score | |
|---|---|---|
| What is scored | One vulnerability (a CVE) | One version of one software product |
| Question it answers | How severe is this flaw? | How risky is it to keep running this version? |
| Scale | 0.0 to 10.0 | 0 to 100 |
| Bands | None 0.0, Low 0.1 to 3.9, Medium 4.0 to 6.9, High 7.0 to 8.9, Critical 9.0 to 10.0 | Low 0 to 25, Medium 26 to 50, High 51 to 75, Critical 76 to 100 |
| Inputs | Four metric groups: Base, Threat, Environmental and Supplemental | Four factors: end-of-life recency (40 points), attack surface (30), CISA KEV exposure (20), extended support availability (10) |
| Knows whether the version is still supported | No | Yes, it is the largest factor |
| Knows whether a fix will ever exist | No | Indirectly: past end of life, the vendor has said no more fixes |
| Covers flaws not yet discovered | No, a score needs a CVE | Yes, in the sense that it rates the state the next flaw will land in |
| Changes over time | Base score is fixed; Threat and Environmental values can be updated by the consumer | Recalculated at every build as dates pass and the KEV catalog changes |
| Who publishes it | FIRST maintains the framework; scores are assigned by CVE numbering authorities and the NVD | endoflife.ai, with the method public |
What's covered
- Side by side
- What CVSS is
- What the EOL Risk Score is
- How to use them together
Full guide with every version, risk scores, and live updates: https://endoflife.ai/article-eol-risk-score-vs-cvss
Top comments (0)