Return to Question

I am using CVSS to do the vulnerability assessment for my project.

As per documentation here is the definition of local and adjacent

Adjacent (A) The vulnerable component is bound to the network stack, but the attack is limited at the protocol level to a logically adjacent topology. This can mean an attack must be launched from the same shared physical (e.g., Bluetooth or IEEE 802.11) or logical (e.g., local IP subnet) network, or from within a secure or otherwise limited administrative domain (e.g., MPLS, secure VPN to an administrative network zone). One example of an Adjacent attack would be an ARP (IPv4) or neighbor discovery (IPv6) flood leading to a denial of service on the local LAN segment (e.g., CVE‑2013‑6014).

Local (L) The vulnerable component is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either: the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or remotely (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., using social engineering techniques to trick a legitimate user into opening a malicious document).

I want to list the assets which will be exploited by local and adjacent threat agents for below components.

1. Client EXE - Which will be installed on devices
2. Cloud system - EXE communicates with a cloud system

Questions:

1. Does EXE fall under both local and adjacent?
2. The VM deployed in cloud system can be accessed by SSH. does it also belongs to local?

Architecture

I am using CVSS to do the vulnerability assessment for my project.

As per documentation here is the definition of local and adjacent

Adjacent (A) The vulnerable component is bound to the network stack, but the attack is limited at the protocol level to a logically adjacent topology. This can mean an attack must be launched from the same shared physical (e.g., Bluetooth or IEEE 802.11) or logical (e.g., local IP subnet) network, or from within a secure or otherwise limited administrative domain (e.g., MPLS, secure VPN to an administrative network zone). One example of an Adjacent attack would be an ARP (IPv4) or neighbor discovery (IPv6) flood leading to a denial of service on the local LAN segment (e.g., CVE‑2013‑6014).

Local (L) The vulnerable component is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either: the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or remotely (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., using social engineering techniques to trick a legitimate user into opening a malicious document).

I want to list the assets which will be exploited by local and adjacent threat agents for below components.

1. Client EXE - Which will be installed on devices
2. Cloud system - EXE communicates with a cloud system

Questions:

1. Does EXE fall under both local and adjacent?
2. The VM deployed in cloud system can be accessed by SSH. does it also belongs to local?
3. accessing resource remotely by SSH is local or network threat agent?

Architecture

I am using CVSS to do the vulnerability assessment for my project.

As per documentation here is the definition of local and adjacent

Adjacent (A) The vulnerable component is bound to the network stack, but the attack is limited at the protocol level to a logically adjacent topology. This can mean an attack must be launched from the same shared physical (e.g., Bluetooth or IEEE 802.11) or logical (e.g., local IP subnet) network, or from within a secure or otherwise limited administrative domain (e.g., MPLS, secure VPN to an administrative network zone). One example of an Adjacent attack would be an ARP (IPv4) or neighbor discovery (IPv6) flood leading to a denial of service on the local LAN segment (e.g., CVE‑2013‑6014).

Local (L) The vulnerable component is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either: the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or remotely (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., using social engineering techniques to trick a legitimate user into opening a malicious document).

I want to list the assets which will be exploited by local and adjacent threat agents for below components.

1. Client EXE - Which will be installed on devices
2. Cloud system - EXE communicates with a cloud system

Questions:

1. Does EXE fall under both local and adjacent?
2. The VM deployed in cloud system can be accessed by SSH. does it also belongs to local?

Architecture

I am using CVSS to do the vulnerability assessment for my project.

As per documentation here is the definition of local and adjacent

Adjacent (A) The vulnerable component is bound to the network stack, but the attack is limited at the protocol level to a logically adjacent topology. This can mean an attack must be launched from the same shared physical (e.g., Bluetooth or IEEE 802.11) or logical (e.g., local IP subnet) network, or from within a secure or otherwise limited administrative domain (e.g., MPLS, secure VPN to an administrative network zone). One example of an Adjacent attack would be an ARP (IPv4) or neighbor discovery (IPv6) flood leading to a denial of service on the local LAN segment (e.g., CVE‑2013‑6014).

Local (L) The vulnerable component is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either: the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or remotely (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., using social engineering techniques to trick a legitimate user into opening a malicious document).

I want to list the assets which will be exploited by local and adjacent threat agents for below components.

1. Client EXE - Which will be installed on devices
2. Cloud system - EXE communicates with a cloud system

Questions:

1. Does EXE fall under both local and adjacent?
2. The VM deployed in cloud system can be accessed by SSH. does it also belongs to local?

Architecture

I am using CVSS to do the vulnerability assessment for my project.

As per documentation here is the definition of local and adjacent

Adjacent (A) The vulnerable component is bound to the network stack, but the attack is limited at the protocol level to a logically adjacent topology. This can mean an attack must be launched from the same shared physical (e.g., Bluetooth or IEEE 802.11) or logical (e.g., local IP subnet) network, or from within a secure or otherwise limited administrative domain (e.g., MPLS, secure VPN to an administrative network zone). One example of an Adjacent attack would be an ARP (IPv4) or neighbor discovery (IPv6) flood leading to a denial of service on the local LAN segment (e.g., CVE‑2013‑6014).

Local (L) The vulnerable component is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either: the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or remotely (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., using social engineering techniques to trick a legitimate user into opening a malicious document).

I want to list the assets which will be exploited by local and adjacent threat agents for below components.

1. Client EXE - Which will be installed on devices
2. Cloud system - EXE communicates with a cloud system

Questions:

1. Does EXE fall under both local and adjacent?
2. The VM deployed in cloud system can be accessed by SSH. does it also belongs to local?

Architecture

I am using CVSS to do the vulnerability assessment for my project.

As per documentation here is the definition of local and adjacent

Adjacent (A) The vulnerable component is bound to the network stack, but the attack is limited at the protocol level to a logically adjacent topology. This can mean an attack must be launched from the same shared physical (e.g., Bluetooth or IEEE 802.11) or logical (e.g., local IP subnet) network, or from within a secure or otherwise limited administrative domain (e.g., MPLS, secure VPN to an administrative network zone). One example of an Adjacent attack would be an ARP (IPv4) or neighbor discovery (IPv6) flood leading to a denial of service on the local LAN segment (e.g., CVE‑2013‑6014).

Local (L) The vulnerable component is not bound to the network stack and the attacker’s path is via read/write/execute capabilities. Either: the attacker exploits the vulnerability by accessing the target system locally (e.g., keyboard, console), or remotely (e.g., SSH); or the attacker relies on User Interaction by another person to perform actions required to exploit the vulnerability (e.g., using social engineering techniques to trick a legitimate user into opening a malicious document).

I want to list the assets which will be exploited by local and adjacent threat agents for below components.

1. Client EXE - Which will be installed on devices
2. Cloud system - EXE communicates with a cloud system

Questions:

1. Does EXE fall under both local and adjacent?
2. The VM deployed in cloud system can be accessed by SSH. does it also belongs to local?

Architecture