Bridging the CVE Gap: Why NVD Alone Isn’t Enough

IoT devices are making their way into every facet of life and business, with almost 4.8 billion IoT devices in use today. These devices are tempting targets for attackers, with 57% vulnerable to high or medium severity attacks. The abundance of these devices leaves gaping holes for attackers to capitalize and pivot to larger targets inside your organization.

Understanding the risk that IoT and other endpoints bring to your organization is crucial for maintaining security. It is not simply about the criticality of these vulnerabilities. More often, it is about the exploitability that comes into play. Cybercriminals can chain low-impact attacks to create footholds in your infrastructure that they can exploit.

Below we will cover how managing exploitability in vulnerabilities plays a significant role in securing your organization.

 

Exploitability Trumps Impact

Gartner’s recent guidance has recognized that managing vulnerabilities is no longer as straightforward as ranking them by CVSS score. Attackers can leverage even lower-impact exploits to gain significant headway into an organization’s security. While this does not mean that all high scores that are both high impact and easily exploited should be ignored, it does mean that there is more nuance to sorting out vulnerabilities that might be scored lower.

For example, a low-impact yet trivially easy vulnerability might calculate out to a score of 4. In contrast, one with high impact but is insanely challenging to exploit may also be scored a 4. The old rules of thumb would recommend going with the highest impact when prioritizing what to fix first, despite it being unlikely to be exploited. Instead, this new methodology avoids dealing with vulnerabilities that will almost certainly be exploitable.

 

Getting Footholds

The reason for reconsidering prioritization in this manner is that quickly executed vulnerabilities can serve as footholds for attacks. While the overall impact of that single vulnerability may not be high nor do much to elevate access, it improves the criminal’s posture during an attack. Think of it like gaining the high ground.

If enough of these low-impact yet highly exploitable vulnerabilities are utilized, they may lower the difficulty of exploiting higher-impact vulnerabilities. This allows attackers to quickly and efficiently escalate up in access to your organization.

 

Chaining Attacks

The foothold argument also leads to the challenge of chaining vulnerabilities. Chaining vulnerabilities happen when multiple lower-impact vulnerabilities are used together to create a higher impact that could not occur individually. This is similar to the scenario above, but the difference is that it does not require a higher impact vulnerability to exist, only the exploitation of multiple exposures together.

While there are ways of identifying scenarios where this can occur, highly trained security personnel require time to spot these scenarios. And in large and complex organizations, this might not even be possible as the amount of data to parse would be overwhelming. In this case, the only reasonable solution is to patch and remediate these holes before criminals can exploit them.

 

Understanding Your Landscape

The only way to gain control of the potential vulnerabilities on endpoints and devices in your organization is to have a complete and in-depth understanding of what can access your infrastructure. This partially comes from having an up-to-date inventory that could come from an existing CMDB (Configuration Management Database). The other part of this equation is to take this inventory and deduce what vulnerabilities exist in the items it contains.

 

Everything Contributes Differently

It is crucial to understand that every device and endpoint has a slightly different contribution to overall risk when identifying vulnerabilities. Consider something as simple as a smartphone, for example. Even if it runs the same OS and the same version as another phone on the network, it has a different set of vulnerabilities due to the various configurations and software. Analyzing this and dealing with each device on a case-by-case basis is crucial for managing your complete threat landscape.

Many existing solutions either scan devices with an installed agent or run credentialed scans against them. While agent-based scans can deliver more in-depth results, it also comes with the challenge of maintaining agent installs and troubleshooting when there are issues. On the other hand, Agentless scans are more network intrusive and not functional for off-site devices and connect via VPN or occasionally on site.

 

Making Informed Decisions

The other part of knowing your landscape comes before acquiring new technology to integrate. The pre-purchase evaluation of products helps your organization understand what they might be getting themselves into and how much work it will take to keep it secure long term. When new devices come on board, they are often left with factory default software and settings. In many cases, these factory default configurations are less than secure. Studies have shown that cybercriminals can attack some IoT devices in less than a minute after being brought online. Identifying if your new technology solutions are a more considerable risk than they are worth before spending time and resources investing in their deployment can save your organization major security headaches in the long run.

 

Digital Precognition

When securing your organization, you need a solution that can thoroughly analyze and assess your attack surface. This solution needs to integrate with the existing data and solutions you already have to deliver in-depth vulnerability information tailored specifically to each device and endpoint.

ArcusTeam DeviceTotal is the Industry’s 1st – Universal Device Security Repository. Our repository draws from the Cybersecurity and Infrastructure Security Agency (CISA) catalog of known exploited vulnerabilities. With this, we can deliver 100% risk accuracy and identify attack vector visibility for each device, site, and organization.

The granular visibility goes beyond risk to calculate actual exploitability for every device. This data provides your organization with a depth of risk visibility that allows you to determine your real priorities. As a fully automated solution, DeviceTotal protects attack surfaces for large organizations that can scale to meet your needs as they change.

Public vulnerability databases like NVD are essential, but they are not sufficient for accurate device risk intelligence. Missing CPE mappings, analysis delays, and version mismatches create critical blind spots that leave organizations exposed.

DeviceTotal delivers exact device risk intelligence, updated daily directly from vendors. Across every case, it achieves 100% recall and provides the operational context needed to act — official EoL timelines, vendor-verified mitigations, fixed-firmware mappings, normalized risk scores, and prioritized actions.

---

Four Standout Results

Cisco IOS 15.9(3)M3

• DeviceTotal mapped 31 CVEs — 35% more than NVD’s 23

• Resolved 24 CPE misassignments (77% false negatives/false positives)

• NVD took four months to correct its mappings

JTEKT PC10PE-1616P

• Public feeds reported 3 CVEs

• DeviceTotal found 5 — a 66% uplift

• These vulnerabilities are still missing from JVN/NVD

Fortinet FortiGate 200F

• NVD missed CVE-2025-22862 entirely

• DeviceTotal surfaced it on disclosure

• Delivered 4.3% more CVEs with full remediation guidance

---

The Problem: NVD Enrichment Backlog Creates Systematic Mapping Errors

Over 2024–2025, a large share of CVEs entered the NVD without enrichment — no CVSS, no CPE product mappings, and often marked “Awaiting Analysis.”

Key statistics:

• 93.4% of CVEs published after Feb 12, 2024 were still unanalyzed as of May 19, 2024

• By Sept 21, 2024, 72.4% (approximately 18,358 CVEs) remained unanalyzed, including 46.7% of Known-Exploited CVEs

• NIST’s March 19, 2025 update confirmed processing had resumed but the backlog was still growing, with roughly 25,000 unprocessed CVEs in March 2025

The impact: When CVSS, CPE, or analysis fields are absent or late, device and firmware matching breaks — yielding the misses and mis-mappings seen in the case studies.

---

Case Study A: Cisco IOS 15.9(3)M3

The problem:

• NVD took four months (Feb 5 – Jul 2, 2025) to correct its mappings

• NVD’s recall lagged at 74.2%, missing 8 of 31 CVEs

DeviceTotal’s result:

• Instantly flagged 31 CVEs on IOS 15.9(3)M3

• Identified 24 CPE misassignments (77% false negatives on the correct train and 77% false positives on the wrong one)

• Delivered 100% recall and zero noise from day zero

---

Case Study B: JTEKT PC10PE-1616P

The problem:

• A Japanese client used local intelligence (JVN/JPCERT) to scan its device

• NVD reported 3 vulnerabilities, confirmed by JVN, leading to an apparent “compliant” status

• Public databases offered no remediation guidance, leaving high-severity risks unaddressed

DeviceTotal’s result:

• Uncovered 2 additional CVEs (MTTT261501, MTTT261502)

• Total of 5 vulnerabilities — a 66% increase over JVN/NVD

• Delivered vendor-verified fixes and full operational context immediately

---

Case Study C: Fortinet FortiGate 200F (FortiOS 7.0.16)

The problem:

• DeviceTotal found 24 CVEs versus NVD’s 23 — a 4.3% uplift

• CVE-2025-22862 was reserved by MITRE on Jan 8, 2025 and disclosed by Fortinet on June 10, 2025

• As of late July 2025, NVD still had no entry (“CVE ID Not Found”)

• No NVD CVSS, no CPE mapping, no references — meaning scanners, SBOM enrichment, and dashboards depending on NVD would not see it at all

DeviceTotal’s result:

• Surfaced the CVE immediately on disclosure

• Provided vendor-verified remediation guidance

The point: This is not about “just one more CVE.” It is about a vulnerability that remains practically invisible to any NVD-only workflow.

---

What Organizations Get Beyond NVD and Other Public Databases

Even when NVD lists a CVE, it typically does not provide the operational context organizations need to act quickly and correctly. DeviceTotal adds the missing, vendor-aligned layers:

• 100% vulnerability coverage

• Insights from the day of disclosure

• End-of-life dates

• Vendor-recommended remediation and mitigation

• Latest firmware versions

• Actionable, prioritized insights

---

Ready to close the CVE gap in your device risk management? Contact us Today!