## 2 Background and Related Work
### Background
#### 2.1.2 Common Vulnerability Scoring System  
The Common Vulnerability Scoring System (CVSS) is a standardized framework designed to quantify and communicate the severity of security vulnerabilities in a systematic and reproducible manner. Developed and maintained by the forum of incident response and security teams (FIRST), CVSS provides a structured methodology for evaluating vulnerabilities based on their intrinsic characteristics, temporal factors, and environmental context. The system generates a numerical score ranging from 0.0 to 10.0, where higher values indicate greater severity, enabling stakeholders to prioritize remediation efforts effectively. The Common Vulnerability Scoring System (CVSS) v4.0 assesses vulnerabilities using four metric groups: base, threat, environmental, and supplemental [14] as shown in Figure 1.  
The CVSS framework has evolved through various versions to refine its approach to vulnerability severity assessment. While earlier iterations, such as CVSS v3.x, primarily utilized Base, Temporal, and Environmental metric groups, CVSS v4.0, which is adopted in this study, introduces significant enhancements and structural changes. Notably, CVSS v4.0 renames the 'Temporal' metric group to 'Threat' and incorporates a new 'Supplemental' metric group, alongside the retained 'Base' and 'Environmental' groups. These changes aim to provide a more nuanced and adaptive framework for evaluating vulnerabilities,  
Figure 1: CVSS model. particularly by better addressing real-time threat intelligence and allowing for the inclusion of organization-specific contextual factors that go beyond the core scoring mechanism. For this study, the base group is prioritized to evaluate vulnerabilities in automotive systems. The exploitability metrics assess the characteristics of the \"vulnerable system\", which refers to the entity directly susceptible to vulnerability. These metrics evaluate the properties of the vulnerability that enable a successful attack, assuming the attacker has advanced knowledge of the target system, including its general configuration and default defense mechanisms. Target-specific mitigations, such as custom firewall rules, are not considered in the base metrics but are instead reflected in the environmental metrics. Specific configurations required for an attack should not influence the base metrics; the vulnerable system is assessed assuming it is in the necessary configuration for exploitation. * The Exploitability Sub-Score (ESS): reflects the ease with which a vulnerability can be exploited. It is determined by four metrics--Attack Vector (\(AV\)), Attack Complexity (\(AC\)), Privileges Required (\(PR\)), User Interaction (\(UI\)), and Attack Requirements (\(AT\)). Each has specific values that contribute to the overall score. The formula for calculating the ESS is illustrated in Equation (1) (all equations, as well as the values specified below, are extracted from [14]): \[\text{ESS}\;=\;8.22\times AV\times AC\times PR\times UI\times AT\] (1)
* Attack Vector (\(AV\)): This reflects the relative ease with which an attacker can access the vulnerable component, effectively indicating the remoteness of the attack. It comprises four standardized values, _Network (N)_, _Adjacent (A)_, _Local (L)_, and _Physical (P)_, each associated with a specific numerical weight that contributes to the Exploitability Sub-Score (ESS). A _Network (N)_ vector, valued at 1.0, implies that the vulnerability can be exploited remotely over one or more network hops, such as in a denial-of-service attack triggered via a crafted TCP packet. An _Adjacent (A)_ vector, with a value of 0.77, indicates the attacker must be in a logically adjacent topology, such as the same subnet, as in an ARP flooding attack. A _Local (L)_ vector, valued at 0.62, requires the attacker to have local access or to rely on user interaction--such as social engineering--to trick a user into executing a malicious file.