How CVSS Attack Vectors Work: From Network to Physical Access
The attack vector metric determines how much effort an attacker needs, shaping the base score before any exploit code is written.
CVSS attack vectors rank difficulty from Network to Physical. Network requires zero physical access, while Local needs existing login. User Interaction means the target must click something. Physical requires touching the hardware. This metric sets the baseline for how exposed a system truly is.
Defining the Attack Surface
The Common Vulnerability Scoring System (CVSS) provides a standardized way to measure severity. The Attack Vector metric is the first component you evaluate. It answers a simple question: how does the attacker reach the vulnerable component? This determination happens before you consider what the vulnerability does. It isolates the accessibility of the flaw from its impact.
You might assume a remote code execution flaw is always worse than a local one. That assumption fails when the local flaw allows root access on a server with no network segmentation. The vector tells you the entry point, not the final damage. Understanding this distinction prevents you from misprioritizing remediation efforts.
Stages of Vector Assessment
You assess the vector by tracing the path from the attacker to the target. Each stage represents a barrier the attacker must cross. Some barriers are digital, others are physical. The CVSS framework assigns a specific label to each barrier type. These labels are mutually exclusive in any single scoring instance.
Stage 1: Network
A Network vector means the vulnerability is exploitable over the internet or an internal network. The attacker can send packets from anywhere with IP connectivity. No physical proximity is required. This is the most dangerous category because the attack surface is global.
Imagine a web server with an unpatched flaw. An attacker in another country can trigger it. The only requirement is that the port is open and the service is running. This vector ignores authentication requirements at this stage. It only cares about reachability.
Stage 2: Adjacent Network
An Adjacent Network vector requires the attacker to be on the same broadcast domain. Think of a local Wi-Fi network or a Bluetooth connection. The attacker cannot reach the target from the public internet. They must be within radio range or connected to the local switch.
This category often applies to IoT device vulnerabilities. These devices communicate via short-range protocols. An attacker must physically enter the building or connect to the guest Wi-Fi. The barrier is physical proximity, not just network access.
Stage 3: Local
A Local vector requires the attacker to have local access to the system. This means they already have a user account or physical console access. They cannot exploit the flaw from a remote machine. They must run code on the target machine first.
This stage is critical for understanding exploit chains. An attacker might use a phishing email to get a low-privilege shell. Then they use a Local vector vulnerability to gain higher privileges. The Local vector is the second step in that sequence.
Stage 4: Physical
A Physical vector requires the attacker to touch the device. They must be within arm's reach to interact with hardware ports or buttons. This is the hardest vector to exploit at scale. It limits the attack to specific locations and times.
Suppose a laptop has a flaw in its firmware update process. An attacker must steal the laptop or access it in a parking lot. They cannot trigger this flaw remotely. The physical barrier provides a strong layer of defense, assuming the device is secured.
| Stage | What happens | Where it can be stopped |
|---|---|---|
| Network | Attacker sends packets from any location | Firewall rules, network segmentation |
| Adjacent | Attacker connects to local wireless or LAN | Wi-Fi encryption, VLAN isolation |
| Local | Attacker runs code on the target system | Principle of least privilege, hardening |
| Physical | Attacker touches the hardware device | Physical security, BIOS passwords |
Reading the Score Impact
The vector metric heavily influences the base score. Network vectors contribute the most points because they are easiest to exploit. Physical vectors contribute the least. This mathematical weighting reflects the effort required.
However, a high base score does not always mean high risk. A Network flaw with no impact is less dangerous than a Physical flaw that destroys data. You must look at the entire CVSS vector string. The vector sets the stage, but the impact metrics tell the story.
Applying to Your Code
As a developer, you can influence the vector by design. Isolating services reduces the chance of a Network vector. If a component only listens on localhost, it becomes Local or Physical. This design choice lowers the CVSS score automatically.
You should also consider configuration hardening. Default settings often expose services to the network. Changing these defaults can shift a vector from Network to Local. This simple change reduces the attack surface significantly.
The Hidden Cost of User Interaction
The User Interaction metric is separate from the vector, but they interact closely. A Network vector with User Interaction requires the target to do something. The attacker sends a link, the user clicks it. This combination is common in web applications.
You might see SQL injection flaws with this combination. The attacker injects code, but the application only executes it when a user triggers a specific action. This lowers the base score compared to an automatic execution. However, it increases the likelihood of success because social engineering is effective.
Integrating with Patch Management
Knowing the vector helps you prioritize patch management. Network vector flaws should be patched immediately. They can be exploited by automated bots scanning the internet. Local vector flaws can wait until the next maintenance window, unless they are part of a known exploit chain.
This prioritization saves time and resources. You focus on the threats that can reach you from afar. You treat local threats as secondary, unless your environment has weak access controls. This approach aligns with risk-based security practices.
Conclusion of Vector Analysis
The Attack Vector metric is the foundation of CVSS scoring. It defines the initial barrier to entry. By understanding each stage, you can better assess risk. You can also design systems that naturally limit the vector to Local or Physical. This proactive approach reduces your overall exposure.
Key takeaways
- Network vectors carry the highest risk because they require no local presence or credentials.
- Local vectors often lead to privilege escalation vulnerabilities when combined with weak access controls.
- User Interaction lowers the base score but increases real-world likelihood via social engineering.
The attack vector determines how easily an attacker can reach your system. Prioritize patching Network vector flaws immediately to reduce exposure.
Frequently asked questions
Does a Network vector always mean the internet?
No, it can mean any IP network, including internal corporate networks. The key is that no physical proximity is needed.
Can a vulnerability have two vectors?
No, CVSS requires a single vector per scoring instance. You choose the most restrictive or most likely path.
How does this relate to privilege escalation vulnerabilities?
Privilege escalation often uses a Local vector. You gain initial access, then use the flaw to get higher rights.
Is Physical vector ever high risk?
Yes, if the device holds sensitive data or controls critical infrastructure. Physical access can bypass many digital controls.
How this guide was produced: written by the Sandbox Dispatch editorial team with AI assistance, checked against the public references listed below, and reviewed when the facts change. See our editorial policy or report an error.
