The cost is derived from the attack tree, and risk and probability are based on CVE
The article is about DoS attack and IoT networks.
CVE is not going to provide that level of information, as you probably saw. CVSS, on the other hand, does. CVE often links to the NVD, which uses CVSS scoring, so it might be an easy mistake to make.
Many information security people confuse "risk" with "impact". So, if we assume that they meant "impact and probability are based on CVSS", then everything makes sense.
Here's an example: https://nvd.nist.gov/vuln/detail/CVE-2017-14888
Impact CVSS v3.0 Severity and Metrics: Base Score: 7.8 HIGH Vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (V3 legend) Impact Score: 5.9 Exploitability Score: 1.8 Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): None Scope (S): Unchanged Confidentiality (C): High Integrity (I): High Availability (A): High
The long string of codes helps to define the problem.
Impact and probability are often determined directly from the "Impact Score" and "Exploitability Score" of the vulnerability. Whether they should do that is another issue entirely. But it is a common practice and a straightforward thing to do for consistency in a research paper.