# Automotive Vulnerability Disclosure: Stakeholders, Opportunities, Challenges
## 6 Related Discussion  
Questions as to whether networked, autonomous vehicles of the future could potentially one day meet the criteria for critical infrastructure could become ever louder (EU Directives 2016/1148 [52] and 2008/114/EC [55]). A vehicle itself is not an infrastructure by definition. But the question, in which extent highly networked fleets interacting with each other and with the infrastructure constitute a \"traffic control and guidance system\". However, with regard to the disclosure of vulnerabilities and security incidents, this would have the consequence of legal reporting and handling obligations for the manufacturers.  
The CVE list as a centralized point for automated synchronization of vulnerability databases and the CVE scheme to uniquely identify, track, and eliminate security issues was introduced in Section 4.1. An increasing number of vulnerabilities are being added to the CVE list (Total: 110 entries, in 2020 33 entries, in 2019 24 entries, by 11/25/20 [54]). These vulnerabilities are thus available to the global automotive environment in a syncronizable form to improve threat intelligence. In their 2020 paper, [PERSON] et al. even propagate the introduction of a special naming system (Common Vehicle Vulnerabilities-CVV), especially for automotive vulnerabilities with its own CVV-ID [56]. The authors see the AUTO-ISAC as a possible central body for maintaining the CVV system. Furthermore, the continous expansion of the Common Platform Enumeration (CPE) [57] with automotive related components should be focused.  
[PERSON] et al. also demonstrate that the Common Vulnerability Scoring Systems (CVSS) [58] from classical IT can easily be adapted for the severity evaluation of automotive vulnerabilities. Other works by FFRI Inc. [59] and [PERSON] et al. [60] reach similar conclusions. In addition, the new ISO/IEC 21434 recommends the CVSS Exploitability metric for the evaluation of automotive attack feasibility.  
Already in the introduction, bug bounty programs were described as common and highly efficient in regular IT. In addition to a VD program, benign hackers can be motivated to stress specifically certain subsystems, or to seek out specific vulnerability types. With this incentive system, manufacturers can take an active role in attracting the world's most skilled hackers. Also for the automotive environment, this can be an important part of a VD strategy. Since 2016, the spread of bug bounty programs has been increasing when FCA established the first automotive OEMs bug bounty program [7, 61]. Since such programs can mean a high investment of time and money, a manufacturer should weight up to what extent such a program is appropriate.  
Effective disclosure and remediation of discovered vulnerabilities in the post-production phase is important for continuous preservation of cyber security. However, patches can only protect against risks once they have been installed in the vehicle. Therefore, the effective dissemination of the developed patches has a key role. To achieve this, over-the-air (OTA) updates are essential. While OTA updates become more frequent in recent years, for today's vehicles software updates can in many cases only be implemented via physical access, which leads to a greatly delayed or uneconomical elimination of potentially dangerous vulnerabilities in post-production phase. Further dissemination of OTA technology is desirable. The world's second-largest passenger car manufacturer, Volkswagen, made the first step in this direction by announcing to offer OTA for their ID.3 and ID.4 models across Europe starting in summer 2021 [62].