An analyst reviews a CVSS v3.1 vector string for a newly disclosed vulnerability: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. What does the AC:H (Attack Complexity: High) metric indicate about exploiting this vulnerability?
- AThe attacker must have physical access to the target device to exploit it
- BThe attacker must already hold elevated privileges on the target before exploitation
- CThe exploit requires no special conditions and succeeds reliably on every attempt
- DSuccessful exploitation depends on conditions outside the attacker's control, such as specific system state or timing
Show answer & explanationAnswer & explanation
Correct answer: D. Successful exploitation depends on conditions outside the attacker's control, such as specific system state or timing
Attack Complexity (AC) in CVSS v3.1 measures conditions beyond the attacker's control that must exist for a successful attack, such as race conditions, specific configurations, or defeating mitigations like ASLR. AC:H means these extra conditions make exploitation less reliable, lowering the exploitability sub-score compared to AC:L.
Why the other options are wrong
- A. Physical access is captured by the Attack Vector (AV:P) metric, not AC.
- B. Privilege requirements are captured by Privileges Required (PR), not AC.
- C. Describes AC:L, not AC:H, since reliable success requires low complexity.
CVSS Attack Complexity (AC)
A CVSS base metric describing conditions beyond the attacker's control that must be present for successful exploitation; values are Low (reliable) or High (unreliable, depends on external factors).
- AC:L = attacker can expect reliable success without special conditions
- AC:H = success depends on conditions like timing, configuration, or defeating a protection
- Higher complexity lowers the exploitability sub-score and often the base score
Memory trick: Attack Vector = where, Complexity = how hard, Privileges = what you need, UI = who else must click.