Skip to content
ENExplore Calculators

CVSS Vector

Free CVSS Vector calculator with clear step-by-step results.

About CVSS Vector

A CVSS v3.1 base score condenses eight metrics into a single 0-10 number plus a machine-readable vector string. The eight choices split into an Exploitability subscore (attack vector, complexity, privileges required and user interaction) and an Impact subscore built from the confidentiality, integrity and availability ratings. Impact is first combined multiplicatively so that three partial losses count for more than any one alone, then rescaled — more steeply when Scope is Changed, because escaping the vulnerable component is what turns a contained bug into a breach. If nothing is impacted the base score is zero no matter how easy the attack is. The final figure is rounded up to one decimal, exactly as the specification requires, so it matches the score a vendor advisory would publish.

Formulas

Impact subscore (Scope Unchanged)

ISC = 1 - (1-C)(1-I)(1-A); Impact = 6.42 x ISC

C
Confidentiality weight
I
Integrity weight
A
Availability weight

Exploitability subscore

Exploitability = 8.22 x AV x AC x PR x UI

AV
Attack vector weight
AC
Attack complexity weight
PR
Privileges required weight
UI
User interaction weight

Base score

Base = 0 if Impact <= 0, else roundUp(min(Impact + Exploitability, 10))

roundUp
Round up to one decimal place, per CVSS v3.1

Worked example

With the default values below, CVSS Vector returns CVSS v3.1 Base Score of 9.1. Change any input above and every figure here is recalculated in your browser.

Inputs used

Attack Vector (AV)one of Network — remotely exploitable, Adjacent — same subnet or Bluetooth range, Local — needs local access or a shell, Physical — needs to touch the device
Network — remotely exploitable
Attack Complexity (AC)one of Low — works reliably every time, High — needs preparation or a race window
Low — works reliably every time
Privileges Required (PR)one of None — unauthenticated, Low — a normal user account, High — an administrative account
None — unauthenticated
User Interaction (UI)one of None — no victim action needed, Required — a victim must click or open something
None — no victim action needed
Scope (S)one of Unchanged — impact stays in the vulnerable component, Changed — impact escapes to another component
Unchanged — impact stays in the vulnerable component
Confidentiality (C)one of High — total disclosure, Low — partial disclosure, None
High — total disclosure
Integrity (I)one of High — total loss of integrity, Low — limited modification, None
High — total loss of integrity
Availability (A)one of High — full denial of service, Low — reduced performance, None
None

Results

CVSS v3.1 Base Score
9.1
Severity Rating
Critical
Vector String
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Impact Subscore
5.18

Step by step

  1. 1Values used
  2. 2Impact subscore (Scope Unchanged)
  3. 3Exploitability subscore
  4. 4Base score
  5. 5CVSS v3.1 Base Score= 9.1
  6. 6Severity Rating= Critical
  7. 7Vector String= CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
  8. 8Impact Subscore= 5.18

Assumptions and limits

  • The result is derived only from the 8 inputs listed above. Anything not among them is not part of the calculation.
  • In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
  • Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
  • This is an unofficial CVSS v3.1 base-score implementation for triage and training. Scores are only as good as the metric choices entered, and they exclude temporal and environmental modifiers. Always confirm severity against the vendor advisory and the official NVD CVSS calculator before using a score to drive patching or compliance decisions.

How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.

This is an unofficial CVSS v3.1 base-score implementation for triage and training. Scores are only as good as the metric choices entered, and they exclude temporal and environmental modifiers. Always confirm severity against the vendor advisory and the official NVD CVSS calculator before using a score to drive patching or compliance decisions.

Frequently Asked Questions

Why does Scope: Changed raise the score so much?

A changed scope means the vulnerability in one component causes damage in a different one — a container escape, a hypervisor break-out, or a browser sandbox bypass. CVSS both raises the privileges-required weights and applies a steeper impact curve, because a bug that stays inside its own trust boundary is far easier to contain.

Is the base score the same as my actual risk?

No. The base score describes the intrinsic, environment-independent severity of the flaw. Real risk also depends on temporal metrics (is there a public exploit, is a patch available) and environmental metrics (does this asset actually hold sensitive data, is it reachable from the internet). Treat the base score as a starting point for triage, not a verdict.

Why is my score zero when the attack is trivial?

CVSS multiplies exploitability by impact rather than adding them independently: if confidentiality, integrity and availability are all rated None, the impact subscore is zero and the specification defines the base score as zero. A flaw with no impact is not a vulnerability under CVSS, however easy it is to trigger.

Related Calculators

CVSS Vector – Calculate CVSS v3.1 Base Score | Calcrivo