Catch Me If You Can: An In-Depth Study of CVE Discovery Time and Inconsistencies for Managing Risks in Critical Infrastructures

Richard J. Thomas, Joseph Gardiner, Tom Chothia, Awais Rashid, Emmanouil Samanis and Joshua Perrett
Submitted to the Joint Workshop on CPS & IoT Security and Privacy (CPSIoTSec)

Conference Proceeding Paper »


Industrial Control Systems (ICS) are central to operation of critical national infrastructure (CNI) such as oil and gas, water treatment, power generation and transport systems. Effective risk management to mitigate large-scale disruption to societies and economies depends on both timely information about vulnerabilities and the consistency of this information. The longer the vulnerabilities remain “in the wild” or a lack of consistency in vulnerability reporting, the greater the impact on CNI operators’ ability to systematically understand and mitigate the risks. In this paper, we focus on vulnerabilities identified and reported in Siemens ICS devices, which hold the largest share of the market. We undertake an in-depth analysis of 207 CVEs, identifying the time over which vulnerabilities were ‘in the wild’ before being discovered and advisories issued, and examine issues with the correctness of CVE information. We find that, on average, a vulnerability is ‘in the wild’ for 5.3 years, and that many CVEs do not correctly reflect and state the affected devices as Common Platform Enumerations (CPEs). Based on our findings, we propose a set of guidelines to improve the reporting and consistency of ICS CVE information.


This paper will be presented at the Joint Workshop on CPS & IoT Security and Privacy (CPSIoTSec), in conjunction with the ACM Conference on Computer and Communications Security 2020 (ACM CCS).


We have published the Datasets that support this publication for the research community to use - please visit our RITICS Datasets GitHub Page.


The paper is available here.