## 6 Evaluation and Discussion
### Evaluation of the Second Experiment  
Using the CCSS framework, initial results will be presented regarding configuration vulnerabilities. Table 3 contains all the factors and an explanation of why each value was chosen. Additionally, the results of the calculation of Exploitability, Impact, and Base are shown.  
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Factor** & **Value** & **Score** & **Explanation** \\ \hline Integrity Impact (I) & Partial (P) & 0.275 & As a result of the attack, the hacker gained access to all virtual machines used in game programming, enabling him to modify any file or attach malicious code to a game. \\ \hline Availability Impact (A) & None (N) & 0.0 & No service was directly disrupted because of this attack. \\ \hline Exploitation Method (EM) & Exploited Actively (A) & non & The hacker was able to access parts of the system after carrying out the attack. \\ \hline Exploitability result & 6.9 & & \\ \hline Impact result & 4.9 & & \\ \hline Base result & 4.9 & & \\ \hline Vector & AV: [N]/AC:[M]/Au:[S]/C:[P]/I:[P]/A:[N]/EM:[A] & & \\ \hline \hline \end{tabular}
\end{table}
Table 2: _Cont._  
\begin{table}
\begin{tabular}{p{113.8 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline
**Factor** & **Value** & **Score** & **Explanation** \\ \hline Access Vector (AV) & Local Access (N) & 0.395 & Obtaining the token requires executing a command locally on the target device. \\ \hline Access Complexity (AC) & Medium (M) & 0.61 & Special permissions are required to extract the token from the target device. \\ \hline Authentication (Au) & Single (S) & 0.56 & A single login attempt is sufficient to exploit this vulnerability. \\ \hline Confidentiality Impact (C) & Complete (C) & 0.660 & The hacker gained owner role access to the subscription scope because of the attack. \\ \hline Integrity Impact (I) & Complete (C) & 0.660 & The hacker gained owner role access to the subscription scope because of the attack. \\ \hline Availability Impact (A) & None (N) & 0.0 & No service was directly disrupted because of this attack. \\ \hline Exploitation Method (EM) & Exploited Actively (A) & non & The hacker was able to access parts of the system after carrying out the attack. \\ \hline Exploitability result & 2.7 & & \\ \hline Impact result & 9.2 & & \\ \hline Base result & 6.0 & & \\ \hline Vector & AV: [N]/AC:[M]/Au:[S]/C:[C]/I:[N]/A:[N]/EM:[A] & & \\ \hline \hline \end{tabular}
\end{table}
Table 3: The second experiment’s evaluation values.  
Based on our experiment's results, the exploitability factor was rated at 2.9 points, suggesting that exploiting this vulnerability would be challenging, due to the requirement for specialized privileges and local execution of the exploit on the target device. In contrast, the impact factor scored 9.2 out of 10 points, indicating a critical level of impact. This high rating can be primarily attributed to the compromised integrity and confidentiality factors, as the attacker gained control over a wide range of subscribers, thereby accessing a significant amount of files and information. If the obtained virtual machine privileges are reduced or a specific scope is selected, the value may decrease to 2.7 out of 10. Finally, the base factor received a rating of 4.9 out of 10. The higher rating is primarily influenced by the elevated impact value compared to previous experiences. Therefore, it is highly recommended to consider all relevant factors, rather than solely focusing on the final value, when assessing vulnerabilities that arise from configuration errors. This holistic approach is crucial in obtaining a comprehensive understanding of the potential risks involved.