## 5 Case Study
### Application of the Assessment Method for Vulnerability  
We applied our assessment method to the vulnerability CVE-2023-36844, which was initially released in August 2023 with a CVSS score of 5.3. This vulnerability pertains to a PHP external variable modification vulnerability in Juniper Networks Junos OS J-Web, which could allow an unauthenticated, network-based attacker to gain control of critical environment variables. Successful exploitation could allow an attacker to cause a loss of system integrity. The chained vulnerabilities are CVE-2023-36845, CVE-2023-36846, and CVE-2023-3684. Here, CVE-2023-36845 was utilized as an initial means of access to control critical environment variables during the course of the attack, and CVE-2023-36846 and CVE-2023-3684 were used to compromise file system integrity on endpoint assets. According to Juniper Networks, the attack campaign compromised approximately 8000+ Juniper instances, with the majority of targets reportedly located in South Korea [30]. To calculate the ECR for this vulnerability, we began by mapping the techniques used to exploit the vulnerability and the techniques that subsequently resulted in impact. As shown in Table 9, we have compiled a list of identified attack techniques and associated tactics linked to vulnerability. Table 9 also provides information regarding the number of attack groups and software that have used these techniques during each phase, in addition to the probability of the technique being used in that specific phase. Based on our identification results, it is evident that this vulnerability is an external variable modification vulnerability that can be exploited for an injection attack. Such an attack could lead to RCE and compromise system integrity. On the basis of this information, we calculated the ECP for the attack technique causing subsequent impacts, considering the weighting of the tactics utilized, resulting in the final ECR as follows:  
\[ \begin{array}{ll}ECP(V)&=P(A)\times\left[1-\left\{\prod_{k=1}^{n}P\left(B_{k} ^{c}\left|A\right)+\prod_{k=1}^{n}P(C_{k}^{c}\left|B\right)\right\}\right]\\ &=1\times\left[1-\left\{\left(0.21\times 0.86\times 0.99\times 0.85\times 0.99 \times 0.9\right)+\left(0.92\times 0.69\times 0.38\right)\right\}\right]\\ &=0.62\end{array}  \tag{7}\] \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multicolumn{1}{c}{**Step**} & **Tactic** & **Technique** & **Procedure** & \multicolumn{2}{c}{
\begin{tabular}{c} **Total** \\ **Procedure** \\ \end{tabular} } & **P(tec)** & **P\({}^{\textbf{C}}\)(tec)** \\ \hline Exploitation Technique & TA0002 & T1059 & 33 & 33 & 1 & 0 \\  & TA0009 & T1005 & 179 & & 0.79 & 0.21 \\  & TA0003 & T1505.003 & 31 & & 0.14 & 0.86 \\ Primary & TA0003 & T1136 & 2 & & 0.01 & 0.99 \\ Impact & TA0001 & T1190 & 34 & 224 & 0.15 & 0.85 \\  & TA0040 & T1565.001 & 2 & & 0.01 & 0.99 \\  & TA0040 & T1485 & 23 & & 0.1 & 0.9 \\ Secondary & TA0040 & T1499.004 & 1 & & 0.08 & 0.92 \\ Impact & TA0003 & & & 13 & & \\  & TA0004 & T1574 & 4 & & 0.31 & 0.69 \\  & TA0005 & & & & & 0.62 & 0.38 \\ \hline \hline \end{tabular}  
* Notes: P(tec): probability of an attack skill being utilized, P\({}^{\textbf{C}}\)(tec): probability of an attack technique not being utilized.  
\end{table} 
Table 9: Identified TTPs and probability information for ’CVE-2023-36844’. \[W(T) =\sum_{k=1}^{n}\{C(T_{k})\times W(T_{k})\} \tag{8}\] \[=\{1.25+1.75+(4\times 1.5)+1+(3\times 2)+1.5+1.25\}=18.75\] \[ECR(V) =ECP(V)\times\sum_{k=1}^{n}\{C(T_{k})\times W(T_{k})\}\] (9) \[=0.62\times 18.75=11.625\]  
We utilized the exploit code availability and the probability of an actual attack exploiting the vulnerability to determine the ease of exploitation. Table 10 shows the metrics utilized to calculate the exploitation risk score for CVE-2023-36844 and a summary of the existing scoring system scores. Multiple sources, including Packetstormsecurity, Zero-day Initiative, and inthewild.io, have identified the vulnerability in question. These sources have reported actual attacks that exploit this vulnerability.