The page itself
Four things on an NVD page, and what each one is actually for
None of these tell you, on their own, whether your specific device on your specific firmware is exposed. That answer is almost always one click away — in the references.
CVSS SCORE & SEVERITY
Tells you how bad it is if you’re affected — not whether you actually are. A 9.8 CRITICAL on a device you don’t run, or a version you’re not on, costs you nothing. Read this last, not first.
DESCRIPTION
A general summary of the flaw, usually written by the CVE’s assignor. For OT/ICS vendor products it rarely names your exact model, firmware branch, or the precise affected-version range — treat it as context, not a verdict.
KNOWN AFFECTED CONFIGURATIONS (CPE)
Sometimes lists a structured version range. Often incomplete or absent entirely for ICS vendor advisories — many vendors publish their own affected-version tables separately rather than feeding them back into this field.
REFERENCES
A list of external links, each tagged with a purpose. This is where the actual answer usually lives — and where most of the confusion comes from, since the tags aren’t explained on the page itself.
References table
Every link is tagged — most of them aren't worth opening
Each reference on an NVD page carries a small tag describing what kind of link it is. Here's what they mean, in the order worth checking them.
"Vendor Advisory"
Open this first
The vendor’s own official bulletin. For Siemens, Rockwell, Schneider and similar, this is usually a link to their product security/CERT portal. It has the specific affected-version table and the exact update to install.
"Patch"
Open this too
A direct link to a fix, firmware update, or code change. Sometimes the same link as the vendor advisory, sometimes a separate download page.
"US Government Resource"
Worth checking for OT
Often a CISA ICS-CERT advisory, which restates the vendor’s findings with an OT-specific lens — sometimes including mitigations the vendor advisory doesn’t mention.
"Mitigation"
Useful if no patch yet
Interim workarounds — disabling a service, restricting network access — for when a fix isn’t released yet or can’t be applied immediately on a live process.
"Third Party Advisory"
Background only
A security researcher or company’s own writeup. Can be informative, but it’s analysis, not an authoritative source for what to actually do.
"Exploit"
Not for remediation
Proof-of-concept attack code. Relevant if you’re assessing how easily this could be exploited against you — not a place to look for a fix.
"Mailing List"
Skip unless stuck
Raw discussion threads, usually from when the flaw was first reported or patched upstream. Rarely the fastest path to an answer.
Worked example
CVE-2014-0160 flagged against a SIMATIC S7-1500
A real case: an S7-1500 CPU on firmware V2.9.4 shows CVE-2014-0160 — "Heartbleed" — as a vulnerability. CVSS 7.5, HIGH. Here's how to work out whether that's actually a problem.
01
Read the description — it doesn’t name your device
The description explains a flaw in the OpenSSL library itself. It doesn’t mention Siemens, S7-1500, or any firmware version — because the CVE was originally filed against OpenSSL, not against any specific vendor’s product. The description alone can’t tell you if you’re exposed.
02
Scan the references for "Vendor Advisory"
Among the reference links is one to cert-portal.siemens.com — Siemens’ own product security portal. That’s the one to open.
03
Open the vendor advisory and find the version table
Siemens’ advisory (SSA-635659) has a table: "Affected Product and Versions → Remediation." The S7-1500 row reads: "V1.5 when HTTPS active" → fix released as "V1.5.1."
04
Compare against your actual firmware
The device in question is on V2.9.4 — many releases past V1.5.1, which shipped in 2014. This device was never exposed to this specific flaw. The CVSS 7.5 score never mattered, because the version condition wasn’t met.
Why it matters
A high CVSS score with no version match is not an exposure. The same advisory that flags a CVE is usually the one that clears it — the affected-version table is doing the real work, not the headline severity number.
Common questions
Reading CVE reports — frequently asked
What if there’s no "Vendor Advisory" link at all?
Go directly to the vendor’s own security/PSIRT advisories page and search by product name — Siemens, Rockwell, and Schneider all publish these independently of NVD. Also check CISA’s ICS advisories, which often cover OT-specific vendor flaws NVD’s reference list hasn’t caught up on yet.
The advisory covers dozens of products — how do I find mine?
Search the advisory’s affected-products table for your exact CPU or module model, not just the general product line name. A single advisory can bundle many unrelated products with different affected-version ranges for each one — the table row for your specific model is what matters, not the advisory’s overall severity.
My exact firmware version isn’t listed — what do I do?
Advisories give ranges (e.g. "all versions < V2.0"), not an exhaustive list of every release. If your version falls inside the stated range, treat it as affected; if it’s outside, you’re clear. When genuinely unsure, the vendor’s own support line will confirm.
Does a high CVSS score mean I need to act today?
Not by itself. Check whether it’s listed in CISA’s Known Exploited Vulnerabilities (KEV) catalogue — that’s the strongest real-world urgency signal — and whether the attack vector requires network access you actually expose, versus local or physical access that a segmented OT network already blocks.
Asset register
Or skip the manual lookup entirely
Add your devices to Control Signal's asset register and it checks reported CVEs against your actual firmware version automatically — daily brief, free for your first device.
Get tomorrow's brief free