The Growing Challenge of CVE Overload
The cybersecurity ecosystem relies heavily on the Common Vulnerabilities and Exposures (CVE) system to uniquely identify security flaws in software and hardware. Managed by MITRE, CVE has become the universal reference for vulnerability tracking. Every major scanner, security platform, and cyber threat intelligence feed uses CVE identifiers to ensure interoperability and standardization.
However, the number of published vulnerabilities continues to grow at an unprecedented rate. With tens of thousands of new CVEs disclosed every year, organizations are confronted with an overwhelming remediation backlog. In large-scale environments—such as telecom infrastructures—each device or system may be affected by hundreds of high-severity vulnerabilities.
Given limited patching windows, operational constraints, supply chain dependencies, and business pressures, remediating everything is simply not feasible. As a result, vulnerability prioritization has become a cornerstone of cybersecurity strategy.
But are current prioritization approaches truly reliable?
Current Prioritization Mechanisms
CVSS: Measuring Severity, Not Risk
The Common Vulnerability Scoring System (CVSS) provides a score from 0 to 10, intended to reflect the technical severity of a vulnerability based on impact and exploitability characteristics.
While CVSS is valuable for standardized severity assessment, it was not designed to measure risk in a specific operational environment. Even with temporal and environmental metrics, CVSS remains largely static and intrinsic to the vulnerability itself.
Critically, CVSS does not account for:
- Real device configurations.
- Network placement and exposure.
- Mitigation mechanisms and hardening (e.g., firewall, IPS, ASLR, DEP/NX, stack canaries, PIE, RELRO).
- Attacker motivation or campaign targeting.
As a result, CVSS is frequently misused as a prioritization metric, even though it measures severity—not likelihood, impact in context, or business risk.
EPSS: Probability Without Context
The Exploit Prediction Scoring System (EPSS), developed by FIRST, attempts to address this gap by estimating the probability that a vulnerability will be exploited in the wild within the next 30 days. Using machine learning techniques, EPSS shifts focus from intrinsic severity to predicted exploitation likelihood.
Although this represents a progress shifting the focus from severity to likelihood, it still operates at a global level. It does not consider the actual operating context, such as:
- Whether the vulnerable component is running (rather than merely installed) on a specific device.
- Whether the service is reachable in the deployed architecture.
- Whether compensating controls prevent exploitation.
- Whether exploitation requires chaining with other vulnerabilities.
A vulnerability predicted to be exploited globally may be practically unreachable in a specific deployment scenario.
KEV: Evidence of Exploitation, but Still Generic
The Known Exploited Vulnerabilities (KEV) catalog, maintained by Cybersecurity and Infrastructure Security Agency, lists vulnerabilities confirmed to be actively exploited in real-world attacks.
KEV is particularly valuable for highlighting urgent threats. However, its applicability remains broad and non-contextual. The presence of a CVE in KEV indicates real-world exploitation—but not necessarily exploitability in a specific device model, firmware configuration, or network architecture.
In highly customized environments, such as telecom-managed devices, this distinction is crucial.
TELEMETRY approach: the Residential Gateway Challenge
In the TELEMETRY project—specifically within the TELCO Use Case—the focus is on Residential Gateways (RGWs).
RGWs represent a particularly sensitive category of devices:
- They connect residential LANs (PCs, IoT, IPTV, etc.) to the Internet.
- They are deployed in very large volumes (millions of units).
- Firmware is often customized by the telecom operator.
- Patch management is operationally constrained.
In such an environment, vulnerability prioritization must be precise. Patching everything is impossible. Patching the wrong CVEs wastes effort and money. Missing a critical chain can result in large-scale compromise.
Moreover, the exploit conditions for RGWs can be extremely specific. A vulnerability exploited in enterprise servers may be irrelevant for an RGW due to:
- Restricted WAN exposure.
- Disabled services.
- NAT and firewall constraints.
- Operator-defined access control models.
Conversely, a vulnerability that appears moderate in isolation may become critical when chained with another weakness in authentication or privilege management.
Generic cyber threat intelligence alone might not be enough to capture these nuances.
A Model-Based, Risk-Driven Approach
To overcome these limitations, the TELEMETRY project adopts a risk-based methodology grounded in a detailed model of the target device.
Instead of starting from generic vulnerability metadata, the approach begins with:
- A structural model of the Residential Gateway
- Service exposure mapping
- Configuration-aware analysis
- Mitigation mechanism evaluation
- Attack path modeling
The key shift is conceptual: From vulnerability-centric prioritization to system-centric risk modeling.
In this framework:
- A vulnerability is evaluated in the context of the specific RGW configuration.
- Exploitability is assessed based on actual reachable attack surfaces.
- Chained vulnerabilities are analyzed as multi-step attack scenarios.
- Compensating controls reduce effective risk where appropriate.
This enables:
- More accurate risk quantification
- Clearer communication to executive management
- Evidence-based remediation prioritization
- Better allocation of limited patching capacity
Why This Matters
Telecom infrastructures cannot rely solely on global severity scores or exploitation probabilities detached from operational reality.
In large-scale deployments such as Residential Gateways, risk is:
- Context-dependent
- Architecture-dependent
- Configuration-dependent
- Chain-dependent
By embedding vulnerability analysis into a device-aware risk model, the TELEMETRY Telco Use Case demonstrates that prioritization can move beyond static scores and toward actionable, defensible risk decisions.
In an era of CVE overload, this evolution is not optional—it is necessary.