## 1 Introduction  
The automotive industry is a cornerstone of the global economy, with major automakers such as General Motors, Ford, and Toyota contributing significantly to gross domestic product (GDP) and technological innovation. Modern vehicles have evolved into complex cyber-physical systems, integrating advanced sensors (e.g., LiDAR and radar) and connectivity frameworks like Vehicle-to-Everything (V2X) to enable autonomous driving and real-time diagnostics [1; 2]. However, this digital transformation has introduced unprecedented cybersecurity risks. Studies reveal that vulnerabilities in electronic control units (ECUs) and sensor networks expose vehicles to attacks such as LiDAR spoofing, Global Positioning System (GPS) manipulation, and denial-of-service (DoS) incidents [3; 4]. Several efforts have been made to address the challenge of cybersecurity risk quantification in the automotive domain. Notably, the HEAVENS 2.0 framework--refined from its original version and formalized in ISO/SAE 21434--provides a risk-oriented model for assessing threats to automotive systems [5; 6]. The Threat Analysis and Risk Assessment (TARA) approach, initially proposed by Intel, has also been adapted for vehicle security assessments, offering a structured method to evaluate attack paths and potential impacts [7]. Additional strategies include attack trees, adaptations of the Common Vulnerability Scoring System (CVSS), and model-based assessments that integrate functional safety standards like ISO 26262 [8]. While these methodologies significantly contribute to the domain, recent academic and industry reviews emphasize that they vary in scope, terminology, and applicability across subsystems [9; 10]. A unified and comparative framework to quantify and contrast cybersecurity risks across heterogeneous automotive components--such as sensors, electronic control units (ECUs), and communication buses--has not yet been fully realized, particularly in safety-critical domains such as collision avoidance and autonomous navigation [11]. During the past decade, some attacks have been simulated, while others have been emulated; however, real incidents have been recorded that affect certain vehicles [12]. These recorded incidents highlight the growing vulnerabilities in automotive systems, particularly in autonomous and connected vehicles. The diverse nature of these attacks, ranging from malware injection and impersonation to jamming and Sybil attacks, underscores the need for robust security measures to safeguard critical vehicle systems. As vehicular technologies continue to evolve, it is imperative to address these security challenges through comprehensive testing, real-time monitoring, and the implementation of advanced defensive strategies to mitigate potential risks [13]. The Common Vulnerability Scoring System (CVSS) is a standardized framework for assessing and communicating the severity of security vulnerabilities [14]. Maintained by the Forum of Incident Response and Security Teams (FIRST), it evaluates vulnerabilities based on intrinsic characteristics, temporal factors, and environmental context. CVSS is widely adopted in IT and automotive cybersecurity, and its flexibility allows adaptation to other critical industries. In healthcare, CVSS has been used to assess vulnerabilities in medical Internet of Things (IoT) devices, such as insulin pumps and pacemakers, where availability and integrity directly impact patient safety [15]. In the energy sector, it aids in prioritizing vulnerabilities in industrial control systems (ICSs), including those affecting smart grid power distribution networks [16]. Financial institutions leverage CVSS to evaluate risks in fintech applications, particularly in blockchain and digital payment systems [17]. Additionally, in the IoT domain, CVSS is applied to assess risks in smart home devices, highlighting the need for environmental metrics to address context-specific threats, such as unauthorized access to security cameras [18].