Laboratory journal. This note traces method, data flow, and mitigation. It does not include exploit instructions, payloads, or reproduction against live systems.
01
Executive Summary
This series answers a different question than patch diffing. Diffing asks why the bug existed. This note asks whether it matters on a real network. CISA’s Known Exploited Vulnerabilities catalog is one input, not the only one.
We will not publish exploit code to “prove” severity. Severity is argued from exposure and impact class.
02
Vulnerability
Start from a published CVE with a published fix. If there is no official record, you are not in this series — you are in disclosure, and this site will not invent an identifier.
03
Affected Software
Record vendor, product, and version range from the official advisory. If your build is outside the range, stop. Residual risk from forks and vendored copies is a separate note.
04
Attack Surface
Surface here means your deployment: is the component installed, reachable, and configured in the unsafe default? A library CVE with no caller in your tree is not your incident.
05
Root Cause
Reuse the invariant from the patch-diffing note if one exists. Risk ranking without root cause is just a spreadsheet of IDs.
06
Data Flow
This is the ranking spine. Every box needs a yes, no, or unknown — unknown is allowed, silent skip is not.
- → CVE
- ↓ Affected versions
- ↓ Exposure (do we run it?)
- ↓ Reachability
- ↓ Authentication required?
- ↓ Network reachable?
- ↓ Exploitability
- ↓ Impact class
- ↓ Known exploitation? (e.g. KEV)
07
Why It Becomes RCE
Assign RCE only when the official record and the patch support an execution sink. Many KEV items are not RCE; they are still urgent because they are exploited. Urgency and impact class are different columns.
08
Patch Analysis
Confirm the fixed version is the one in your artifact. Read whether the patch is on by default. A fix that requires a config flag you did not set is not a fix in your environment.
09
Detection
Version inventory, SBOM, and listening-port maps beat generic IDS signatures copied from a blog. If you lack a version inventory, you cannot finish this series honestly.
10
Mitigation
Patch first when the ranking is high. If you cannot, reduce exposure: remove the component, bind it off-network, require authentication, or disable the unsafe encoder. Document residual risk.
11
Lessons Learned
The laboratory’s three axes meet here: RCE research names the sink, CVE research names the invariant, AI infrastructure research names the modern place it shows up. Risk ranking decides what we work next — not the loudest identifier.
12
References
CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog
NVD / CVE records — official version ranges and references.
Art of Vector Security disclosure policy — /about/responsible-disclosure.
Continue
- 05 — Authentication → Authorization → Privilege Escalation
CVE to Real Risk
- 06 — SSRF: From URL Parser to Server-Side Impact
CVE to Real Risk
- 07 — API Authorization Vulnerability Research
CVE to Real Risk