Core Concepts
There are around 1000 exploitable cybersecurity vulnerabilities that have not been tracked or documented by MITRE, NIST, and other major vulnerability tracking organizations, but may have been discovered and exploited by adversaries like China and Russia.
Abstract
The article discusses a set of cybersecurity vulnerabilities that have not been assigned CVE (Common Vulnerabilities and Exposures) identifiers by MITRE and NIST, the leading vulnerability tracking organizations. These vulnerabilities have instead been mapped to other vulnerability databases like CNVD, CNNVD, and BDU, which are less widely used globally.
The author, representing the A.R.P. Syndicate, a cybersecurity intelligence company, claims that their Exploit Observer's VEDAS (Vulnerability & Exploit Data Aggregation System) has identified around 1000 such vulnerabilities. They argue that while the CVE ecosystem is improving, it still misses a significant number of real-world vulnerabilities that may have been discovered and exploited by adversaries like China and Russia.
The article emphasizes that the false negatives (missed vulnerabilities) are more concerning than false positives (incorrectly identified vulnerabilities) in automated security systems. It encourages independent researchers to test and verify the findings, and report any discrepancies.
The author also highlights that China and Russia's domestic vulnerability tracking systems, like CNITSEC and FSTEC, may have better coverage of the global vulnerability ecosystem than is publicly revealed. This poses a concern for security teams that rely primarily on the CVE system.
The article introduces the Exploit Observer's VEDAS as a solution, which aggregates and interprets exploit and vulnerability data from various sources. It claims that VEDAS has a unique scoring algorithm that focuses on how easily an adversary can exploit a vulnerability, rather than just the severity.
Stats
There are around 1000 exploitable cybersecurity vulnerabilities that MITRE, NIST, and other major vulnerability tracking organizations have missed.
The CVE ecosystem has over 370+ CNA (CVE Numbering Authority) partners generating input 24/7, and the CVE database is constantly improving.
China and Russia's domestic vulnerability tracking systems, like CNITSEC and FSTEC, may have better coverage of the global vulnerability ecosystem than is publicly revealed.
Quotes
"CVE ecosystem has 370+ CNA partners generating invaluable input 24x7. A lot of changes happen everyday in the CVE Database & it's only getting better with time."
"CVE is the worst vulnerability framework (Except for all the others) — From Vulncon 2024"
"China's New Vuln System — From Vulncon 2024"