Step 115. How to Read a CVE: NVD and Exploit-DB — The Story Packed into a Single Number

Level 2 — Introduction to Security and the Basics of Attack Skills | Difficulty ★★☆☆☆ | Estimated time: 2 hours

Prerequisites: you’ve seen the CVE candidate list the scanner produced in Step 114. You’re comfortable with service-name + version notation like "vsftpd 2.3.4."

• What you need: a web browser (for NVD and Exploit-DB). If you have the lab’s Kali, searchsploit too. This is a reading-focused chapter with almost no command practice.
• Caution: ⚠️ All exercises in this chapter are for your own lab and legal platforms only. Applying them to unauthorized systems is a crime. Reading attack code (PoC) is study; running it against someone else’s system is a crime. This environment has no external network access, so all NVD and Exploit-DB screens and searchsploit output are marked as "Screen example."

In Step 114 the scanner threw us a number: "CVE-2011-2523." What is this number, where do you read it, and how much should you trust it? Today we learn the language that circulates in the world of vulnerabilities — CVE numbers, CVSS scores, and PoC (proof-of-concept code). The search skill that chains "version number → vulnerability information → does attack code exist?" is the core of professional reconnaissance, and the two sites we learn today (NVD and Exploit-DB) are the starting points of that search.

1. Learning Objectives

By the end of this chapter, you will be able to:

• Explain the structure of a CVE number (year + serial number) and state the difference in roles among CVE, NVD, and Exploit-DB
• Read a CVSS score (0–10) and vector string to interpret severity
• Find "description, score, affected versions, reference links" on a single NVD page
• Check "has attack code been published?" with Exploit-DB and searchsploit
• Explain the difference between "high score" and "dangerous in practice"

2. Background Knowledge — Today’s Tools and Concepts

Today’s Tools at a Glance

2-1. CVE — A Vulnerability’s National ID Number

CVE (Common Vulnerabilities and Exposures) is the unique identifier assigned to vulnerabilities worldwide. Its shape is CVE-year-serialnumber. CVE-2011-2523 means "the 2523rd candidate registered in 2011."

Before numbers existed, the same vulnerability was called different names by every company. After numbers arrived, scanners, news, and patch notices all point to the same number. That’s why Step 114’s scanner output was summarized into CVE numbers — the number itself is the world’s shared index.

2-2. NVD and CVSS — The Details and Score Attached to a Number

The NVD (National Vulnerability Database) is the detail page for each CVE number. The severity score it carries is the CVSS (Common Vulnerability Scoring System) — a number between 0.0 and 10.0, classified as High at 7.0 or above and Critical at 9.0 or above.

Next to the score hangs a cipher-like string called the vector. For example, AV:N/AC:L/Au:N/C:C/I:C/A:C compresses, item by item: "from where can it be attacked (network) / are conditions demanding (low) / is authentication required (none) / damage to confidentiality, integrity, availability (all complete)." Read the vector and you see the grounds for the number.

2-3. Exploit-DB and PoC — The Evidence of "Does It Actually Break?"

Exploit-DB is a repository of published attack code — PoC (Proof of Concept). Kali Linux ships with an offline copy of this DB, searched without the internet via the searchsploit command.

Here’s today’s most important instinct. A CVSS score tells you "how bad is it in theory," but practical danger is better told by "has attack code been published that anyone can copy and run?" A vulnerability scored 10.0 with no attack code is a researcher’s job; a vulnerability scored 7.5 with code everywhere becomes a script kiddie’s toy.

2-4. Today’s Case — The vsftpd 2.3.4 Backdoor (CVE-2011-2523)

Today’s textbook for reading is CVE-2011-2523. In 2011, the distribution file of the popular FTP server program vsftpd was swapped by an attacker, and version 2.3.4 was distributed with a backdoor planted inside. If a username contains the string :), a root-privilege shell opens on port 6200. It’s the classic case of a supply chain attack — and the very vulnerability we will breach ourselves in Step 117.

3. Follow Along

3-1. Reading CVE-2011-2523 on the NVD

Open the NVD (nvd.nist.gov) in a browser and enter CVE-2011-2523 in the search box. Since this environment has no external network access, we’ve reconstructed below what you’ll see (Screen example).

Screen example (the NVD’s CVE-2011-2523 page, reconstructed excerpt):

CVE-2011-2523 Detail

Description
vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a
backdoor which opens a shell on port 6200/tcp.

Base Score: 10.0 CRITICAL
Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C  (CVSS v2)

How to read it: find four boxes. ① Description — a one-sentence summary of what happened. Here you find the key information ("opens a shell on port 6200"). ② Base Score — a perfect 10.0. ③ Vector — the grounds for the score. ④ Further down the page, the affected versions and reference links (original notices, patch information).

Why: this is the first act of reading that turns the number the scanner threw into human language. Notice that a single Description sentence contains both the attack conditions and the result.

3-2. Dissecting the CVSS Vector — Decoding the Cipher

Let’s unpack the vector we just saw, AV:N/AC:L/Au:N/C:C/I:C/A:C, item by item. Each letter pair is "item:value."

How to read it: all six boxes are on the worst (best) side for an attacker. From the network, with no special conditions, without authentication, swallowing the system whole — hence 10.0. Build the habit of reading vectors and you can nod along to "why this score." Newer documents use CVSS v3 vectors (CVSS:3.1/AV:N/AC:L/PR:N/...); only the item names differ (PR, UI, and so on) — the way of reading is the same.

Why: if you look only at the score, it ends at "10 points, so scary"; if you look at the vector, you see "scary in what situation." Defense priorities are set by this context.

3-3. Finding Attack Code on Exploit-DB

Now we check "has code that actually breaks it been published?" Enter vsftpd 2.3.4 in Exploit-DB’s (exploit-db.com) search box (Screen example).

Screen example (search results, reconstructed):

EDB-ID  17491   vsftpd 2.3.4 - Backdoor Command Execution (Metasploit)
EDB-ID  49757   vsftpd 2.3.4 - Backdoor Command Execution

How to read it: each row is an EDB-ID (Exploit-DB number) and a title. The "(Metasploit)" tag means this attack also exists as a Metasploit module — the very module we will use in Step 116. Clicking an EDB-ID shows you the attack code itself. Reading and running are different things. Running is for your own lab only.

Why: if the NVD is "the vulnerability’s diagnosis chart," Exploit-DB is "the warehouse of surgical tools." You can’t break anything with the chart alone, and with tools alone you don’t know why it works. Moving between the two completes reconnaissance.

3-4. searchsploit — Searching the Warehouse Without the Internet

Kali has an offline copy of Exploit-DB, so searching works even in places without internet, like the lab (this environment has no Kali, so this is a Screen example).

Input (on Kali)

searchsploit vsftpd

Screen example:

---------------------------------------------------------- ---------------------------------
 Exploit Title                                            |  Path
---------------------------------------------------------- ---------------------------------
vsftpd 2.3.2 - Denial of Service                           | linux/dos/16270.c
vsftpd 2.3.4 - Backdoor Command Execution (Metasploit)     | unix/remote/17491.rb
vsftpd 2.3.4 - Backdoor Command Execution                  | linux/remote/49757.py
---------------------------------------------------------- ---------------------------------

How to read it: the left side is the title; the right side is the file path inside Kali. To copy a code file into your working directory, give the EDB-ID to the -m (mirror) option, like searchsploit -m 49757. That -m takes a number, not a title, is a classic beginner mistake.

Why: at a closed-network penetration test site, the offline DB is the only warehouse. And notice that the results mix various languages — .py, .rb, .c. Attack code is just a program, too.

3-5. Making a Reading Card — From Inventory to Attack Code

To wrap up, let’s fix today’s search skill into a single format. Pick one service from your Step 113 inventory and make a "reading card."

Card example (vsftpd 2.3.4):

Service/version: vsftpd 2.3.4  (verified with -sV in Step 113)
CVE:             CVE-2011-2523
One-line summary: backdoor planted in the distribution — root shell on port 6200
CVSS:            10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C) — network, no auth, full takeover
Attack code:     Exploit-DB 17491 (Metasploit), 49757 (Python) — published
Field judgment:  perfect score + published code + simple conditions = top verification priority

Why: with these five lines, "what to do next" decides itself. The moment you start Metasploit in Step 116, you already know which module to look for.

3-6. Not Every Number Is Readable — The States of a CVE

One honest exception to finish. Sometimes you search a CVE number on the NVD and the content is empty or odd. That’s because numbers have states.

• Analyzed / Modified: the normal state — review complete, score and details filled in. This is what we read today.
• Awaiting Analysis: the number is assigned, but the NVD’s analysis isn’t done yet. Follow the news of a freshly broken vulnerability and you’ll meet this state.
• REJECT: a number that was assigned and then cancelled — it was a duplicate, or it turned out not to be a vulnerability after all. As a screen example, it’s written large: <strong> REJECT </strong> DO NOT USE THIS CANDIDATE NUMBER.

How to read it: if you see a REJECT mark, that number is discarded. A "see this number instead" notice often comes along in the reference links. Scanners sometimes spew stale numbers, so today’s cross-validation habit is needed here too.

Why: "a number exists" and "valid information exists" are different things. Today’s attitude of not taking a tool’s output at face value works at the database stage as well.

4. Missions & Exercises

Mission — Three CVE Reading Cards

1. Pick 3 services from your Step 113 inventory (or Step 114’s CVE candidate list). If you don’t have the MS2 lab, you may substitute this book’s cases (vsftpd 2.3.4, OpenSSH, Apache 2.2.8, and so on).
2. Find one CVE for each service on the NVD and copy its Description, Base Score, and Vector.
3. Unpack at least one vector item by item, like the table in 3-2.
4. Check whether attack code is published on Exploit-DB (or Kali’s searchsploit), down to the EDB-ID.
5. On the card’s last line, write a "field judgment" in one sentence — considering both the score and whether code exists.

Exercises

Exercise 1. In the number CVE-2014-0160 (Heartbleed), what do 2014 and 0160 each mean? And what problem existed before this numbering system?

Exercise 2. Compare the vectors AV:N/AC:L/Au:N/C:C/I:C/A:C and AV:L/AC:H/Au:M/C:P/I:P/A:N, and explain which is more dangerous and why, using the vector as your basis.

Exercise 3. Between "a CVSS 9.8 vulnerability with no published attack code" and "a CVSS 7.5 vulnerability with a Metasploit module," which will a tester who must breach the lab’s MS2 tonight verify first? Why?

Exercise 4. What is the Path column in searchsploit results, and what is the correct command to bring that file into your own directory?

Service/version: OpenSSH <version>
CVE:             selected by NVD search
One-line summary: copy the Description's first sentence verbatim, underlining the key conditions
CVSS:            score + the vector verbatim
Attack code:     the EDB-ID of the row whose version matches in searchsploit openssh results
Field judgment:  synthesize score, code, and conditions (authentication needed? specific configuration?)

6. Common Pitfalls & Fixes

Wall 1. I confuse CVE and EDB-ID

Symptom: you enter CVE-2011-2523 in Exploit-DB’s search box and feel the results are odd — or conversely, you enter an EDB-ID on the NVD.

Cause: the two repositories use different numbering systems. A CVE is a vulnerability’s number; an EDB-ID is attack code’s number. One CVE can have several EDB-IDs attached (like 17491 and 49757).
Fix: remember it as "to read a vulnerability, use the CVE on the NVD; to find code, use the service name on Exploit-DB." The reference links on an NVD page serve as the bridge.

Wall 2. I set priorities by score alone

Symptom: you sort by CVSS descending and verify from the top.

Cause: the score measures "the worst case when conditions hold." A 7-something with code everywhere can be more dangerous today than a perfect score with no code or demanding conditions.
Fix: add "does published code exist?" and "attack conditions (authentication needed? specific configuration?)" to your sort criteria. Today’s reading card format shows those three at a glance.

Wall 3. I give up because the Description’s English is long

Symptom: you open an NVD page and stop reading at the Description paragraph.

Cause: CVE descriptions are on the concise side, but they mix in jargon.
Fix: there are only three clues to find — "what (which input)," "what does it open (a shell? code execution? information leak?)," "up to which version." Underline just these three and you can skip the rest. For CVE-2011-2523, "backdoor / opens a shell on port 6200 / vsftpd 2.3.4" was everything.

Wall 4. I put a title into searchsploit -m

Symptom (Screen example): you type searchsploit -m "vsftpd 2.3.4" and get results different from what you intended.

Cause: what -m (mirror) accepts is an EDB-ID number.
Fix: first search with searchsploit vsftpd to check the number in the list on the left, then pass only the number, like searchsploit -m 49757.

Wall 5. Old and new vectors differ and it’s confusing

Symptom: some pages use Au:N; others use PR:N.

Cause: CVSS v2 and v3 have different item names (v2’s Au was subdivided into PR and UI in v3). Old vulnerabilities like CVE-2011-2523 are written with v2 vectors.
Fix: the way of reading is the same — find the four questions: "from where / how demanding / is authentication needed / what’s the damage?" Only the notation differs.

7. Summary

Today’s Concepts

Today’s Commands and Sites

An Instinct More Important Than Commands

The search chain running "version number → CVE → attack code" is today’s substance. When the scanner throws you a number, you read the diagnosis on the NVD and check whether tools exist on Exploit-DB — completing these three steps within 5 minutes was today’s completion criterion.

And one final instinct. Take the score as reference; look at whether code exists. CVSS 10.0 and "code exists on Exploit-DB" are different kinds of information — the former is how bad it is, the latter is whether anyone can do it. CVE-2011-2523 is legendary because both apply. Only with the card’s last line, the "field judgment," does it become automatic which module to look for when you start Metasploit next (Step 116).

Once every box is checked, Step 115 is complete.