Vulnerability Assessment Framework Based on In-The-Wild Exploitability for Prioritizing Patch Application in Control System

With the increasing understanding of attackers towards the characteristics of control systems and the growing connectivity with information technology, security incidents targeting control systems are on the rise. The number of vulnerabilities related to these incidents are increasing every year, making it impossible to apply timely patches for all vulnerabilities. The current common vulnerability assessment framework, which is considered the basis for vulnerability patching, has limitations in that it does not consider the weaponization after vulnerability discovery and does not adequately reflect the exploitability in real-world “in-the-wild” environments. Therefore, in this study, we propose an approach to evaluate the in-the-wild exploitability and risk of vulnerabilities occurring in control systems based on publicly available data. To achieve this, we define criteria for classifying attacker skill levels and improve the existing CVSS metrics by introducing new factors for evaluating exploitability and risk. By applying this evaluation approach, we can identify vulnerabilities in control systems that are likely to be exploited in real-world scenarios, enabling prioritized patching and proactive defense against advanced persistent threat (APT) attacks.