[Paper Review] Towards an open standard for assessing the severity of robot security vulnerabilities, the Robot Vulnerability Scoring System (RVSS)

Víctor Mayoral Vilches, Endika Gil-Uriarte+8 more|arXiv (Cornell University)|Jul 26, 2018

Information and Cyber Security5 references14 citations

TL;DR

This paper proposes the Robot Vulnerability Scoring System (RVSS) v1.0, an open, standardized scoring framework tailored for robotics security that extends CVSSv3 by integrating robot-specific factors such as safety impact, environmental exposure, third-party library risks, and vulnerability age. RVSS produces more accurate severity scores than CVSSv3 for cyberphysical systems, with experimental validation showing significant divergence in risk assessment for real-world robot vulnerabilities.

ABSTRACT

Robots are typically not created with security as a main concern. Contrasting to typical IT systems, cyberphysical systems rely on security to handle safety aspects. In light of the former, classic scoring methods such as the Common Vulnerability Scoring System (CVSS) are not able to accurately capture the severity of robot vulnerabilities. The present research work focuses upon creating an open and free to access Robot Vulnerability Scoring System (RVSS) that considers major relevant issues in robotics including a) robot safety aspects, b) assessment of downstream implications of a given vulnerability, c) library and third-party scoring assessments and d) environmental variables, such as time since vulnerability disclosure or exposure on the web. Finally, an experimental evaluation of RVSS with contrast to CVSS is provided and discussed with focus on the robotics security landscape.

Motivation & Objective

• Address the inadequacy of CVSSv3 in assessing robot security vulnerabilities due to its focus on traditional IT systems rather than cyberphysical systems.
• Develop a standardized, open, and extensible scoring system that accounts for robotics-specific risks such as physical safety impacts and environmental exposure.
• Enable accurate, consistent, and comparable vulnerability severity ratings across robotics platforms, especially for vulnerabilities involving third-party libraries and long-disclosed issues.
• Provide a foundation for vulnerability management in robotics by supporting prioritization of remediation efforts based on realistic risk profiles.
• Foster community adoption and collaborative improvement of the scoring system through open-source implementation and public review.

Proposed method

• Adapt the CVSSv3 vector-based scoring model to include robot-specific metrics, particularly modifying the Attack Vector (AV) and introducing a new Safety (H) metric to reflect physical harm potential.
• Introduce an Age modifier to quantify the risk increase of unpatched, disclosed vulnerabilities over time, reflecting real-world exposure duration.
• Revise the Impact metric subgroup to allow non-zero scores for third-party components (e.g., libraries, middleware), using a worst-case scenario approach to reflect supply chain risks.
• Integrate environmental context into the scoring model, including system sensitivity (S:U), and re-evaluate impact based on potential for physical damage or system compromise.
• Define a base score calculation using a modified formula: Base_score = round_up(min[Exploitability + Impact, 10]), where both components are derived from weighted vector metrics.
• Ensure backward compatibility with CVSSv3 by preserving core structure while extending semantics and weights to reflect robotics-specific threat models.

Experimental results

Research questions

• RQ1 How does the severity of robot vulnerabilities differ from traditional IT vulnerabilities, particularly in terms of safety and physical impact?
• RQ2 To what extent does the inclusion of environmental exposure and vulnerability age improve the accuracy of risk assessment in robotics?
• RQ3 Can a modified scoring system that accounts for third-party software components and libraries produce more realistic severity ratings than CVSSv3 for robotics?
• RQ4 How does the proposed RVSS v1.0 compare quantitatively and qualitatively to CVSSv3 in real-world robot vulnerability assessments?
• RQ5 What are the key factors that differentiate robot vulnerabilities from general software vulnerabilities, and how can they be systematically captured in a scoring framework?

Key findings

• RVSS v1.0 produces a severity score of 5.9 for a representative robot vulnerability involving unauthenticated remote access, demonstrating a more nuanced assessment than CVSSv3.
• The inclusion of a Safety (H) metric significantly increases impact scores for vulnerabilities with physical harm potential, distinguishing them from purely IT-based risks.
• The Age modifier increases the score of long-disclosed, unpatched vulnerabilities, reflecting their growing risk over time, which CVSSv3 fails to capture.
• Third-party libraries and middleware can now be scored with non-zero impact values, enabling better assessment of supply chain risks in robotics systems.
• Experimental evaluation shows that RVSS produces substantially different severity rankings than CVSSv3 for robot-specific vulnerabilities, particularly in safety-critical scenarios.
• The proposed system enables retrospective compatibility with CVSSv3, allowing direct comparison and migration of existing vulnerability reports to the new framework.