CVE Severity: Risk-Based Prioritization

CVE 严重性：基于风险的优先级排序

In large networks, security teams receive hundreds of CVE notifications every day. It is resource-intensive to patch all vulnerabilities at once and immediately. CVE Severity is based on the CVSS (Common Vulnerability Scoring System) system, which measures the risk of vulnerabilities from 0.0 to 10.0, and serves as a compass for teams to prioritize which threats to address. 在大型网络中，安全团队每天都会收到数百条 CVE（通用漏洞披露）通知。一次性且立即修补所有漏洞需要消耗大量资源。CVE 严重性基于 CVSS（通用漏洞评分系统），该系统将漏洞风险衡量为 0.0 到 10.0 分，并作为团队确定威胁处理优先级的指南。

Severity Levels and Response Strategies

严重性级别与响应策略

The CVSS framework categorizes vulnerabilities into four different severity levels. Each level requires a different response time: CVSS 框架将漏洞分为四个不同的严重性级别。每个级别都需要不同的响应时间：

Critical Level (CVSS 9.0 – 10.0) 严重级别 (CVSS 9.0 – 10.0)

• Characteristics: Can be exploited over the Internet, without user interaction, and without requiring any special privileges. Allows for full system control (Remote Code Execution). 特征： 可通过互联网利用，无需用户交互，也无需任何特殊权限。允许完全控制系统（远程代码执行）。
• Strategy: Urgent Incident Response. No scheduled maintenance is expected. 策略： 紧急事件响应。无需等待计划内维护。
• Response Time: Within 24 - 48 hours. If no official patch is available, immediate virtual patching is applied through the Web Application Firewall (WAF). 响应时间： 24 - 48 小时内。如果没有官方补丁，则通过 Web 应用防火墙 (WAF) 进行即时虚拟补丁修复。

High (CVSS 7.0 - 8.9) 高危级别 (CVSS 7.0 - 8.9)

• Features: Allows Privilege Escalation or bypassing of critical security filters. However, exploitation may require specific user actions, such as local network access or phishing. 特征： 允许提权或绕过关键安全过滤器。但利用该漏洞可能需要特定的用户操作，例如本地网络访问或网络钓鱼。
• Strategy: Accelerated Patching. Monthly queues are unexpectedly pushed into the next update cycle. 策略： 加速修补。将月度队列提前至下一个更新周期。
• Response Time: Within 1 - 2 weeks. 响应时间： 1 - 2 周内。

Medium (CVSS 4.0 - 6.9) 中危级别 (CVSS 4.0 - 6.9)

• Features: Requires complex conditions, internal user permissions, or physical access to exploit. Impact is typically limited and does not bring down the entire infrastructure. 特征： 利用条件复杂，需要内部用户权限或物理访问。影响通常有限，不会导致整个基础设施瘫痪。
• Strategy: Scheduled Patching. Scheduled to fit into standard IT maintenance cycles and monthly routine update windows. 策略： 计划内修补。安排在标准的 IT 维护周期和月度例行更新窗口内进行。
• Response Time: Within 30 - 90 days. 响应时间： 30 - 90 天内。

Low (CVSS 0.1 - 3.9) 低危级别 (CVSS 0.1 - 3.9)

• Characteristics: Minimal security impact. Typically small leaks such as software version number disclosure (information disclosure) and not sufficient for a single cyberattack. 特征： 安全影响极小。通常是诸如软件版本号泄露（信息泄露）等小问题，不足以构成单一的网络攻击。
• Strategy: Low Priority / Monitoring Only. Performed during major system updates or when resources allow. 策略： 低优先级/仅监控。在重大系统更新期间或资源允许时执行。
• Response Time: When resources and time are available (no time limit). 响应时间： 在资源和时间允许时（无时间限制）。

Conclusion

结论

Organizations are moving from a haphazard “patch everything” approach to a risk-based, systematic defense model by directly aligning their response to the severity of CVEs. 各组织正在从杂乱无章的“修补所有漏洞”方法转向基于风险的系统化防御模型，通过将响应措施直接与 CVE 的严重性挂钩来提升安全性。