I've been looking for information about vulnerability classification and it's not completely clear to me.
Reading the CVSS documentation (2.1.1. Access Vector) I observe the following explanation about the N (Network) value for AV (Access Vector):
"A vulnerability exploitable with network access means the vulnerable software is bound to the network stack and the attacker does not require local network access or local access. Such a vulnerability is often termed "remotely exploitable". An example of a network attack is an RPC buffer overflow."
In my opinion, this means that the vulnerability can be exploited remotely, but possibly also locally ("not required").
Am I right?