10.1 Target Prioritization: CVSS, CVE, CWE, and EPSS

Domain 4, Attacks and Exploits, is 35 percent of CompTIA PenTest+ PT0-003 — the largest scored domain. Objective 4.1 Given a scenario, prioritize and prepare attacks is the gate in front of every later 4.x technique. Before you pick a tool or touch an exploit, you decide what to shoot first and whether you should shoot at all. Testers who always exploit the highest CVSS number fail 4.1. Testers who ignore a domain controller because its score is 7.5 while a lab printer is 9.8 also fail 4.1.

CompTIA splits 4.1 into two jobs. This section is target prioritization: high-value asset identification; descriptors and metrics (CVSS base score, CVE, CWE, EPSS); end-of-life software and systems; default configurations; running services; vulnerable encryption methods; and defensive capabilities. The next section is capability selection — tools, exploit customization, and the documentation you write before firing.

High-value asset identification

A high-value asset (HVA) is a system whose compromise produces outsized business or safety impact, not merely a high scanner score. On PT0-003, treat these as first-class HVAs unless the statement of work (SoW) says otherwise:

• Domain controllers and other identity providers (Active Directory, LDAP, cloud IAM)
• Jump hosts / bastions that already hold privileged paths into many networks
• Crown-jewel databases holding cardholder data, ePHI, payroll, or trade secrets
• CI/CD systems (source control, build servers, artifact registries) that can poison every downstream deploy
• OT/ICS safety systems whose failure is a physical event, not just a data leak

High value cuts two ways. An HVA is usually a priority target when it is in scope and an attack path exists. The same class of asset may be a labeled sensitive system in the rules of engagement (RoE): you still identify it as high value, but you treat it gently — lower scan intensity, extra approval, or stop at proof without a crashing exploit. Identification is not a free-fire license. A clinical infusion pump, a safety PLC, or a production payment switch can be the most important box on the diagram and still be the last thing you are allowed to crash.

Exam trap: a public marketing site with a critical plugin is not automatically more valuable than an internal jump host with a medium finding. Ask what the asset unlocks. If compromising the marketing CMS gets you a defacement and compromising the jump host gets you every subnet, the jump host wins even when the CMS CVSS is larger.

Descriptors and metrics: CVSS, CVE, CWE, EPSS

PT0-003 names four descriptors. They answer different questions. Mixing them is the most common 4.1 miss.

CVSS base score

The Common Vulnerability Scoring System (CVSS) is owned by FIRST.org. The official specification lives at https://www.first.org/cvss/. CompTIA's wording is CVSS base score. The Base score is a number from 0 to 10 that reflects intrinsic severity — how bad the issue is if it is exploited — not a prediction that it will be exploited. Environmental or threat/temporal modifiers, when a report includes them, describe a specific deployment or current exploit climate. The exam bullet is the Base score; do not pretend Base already baked in "this will be used by ransomware next week."

Do not claim PT0-003 tests only one CVSS version. CVSS v3.1 is still widely published on the U.S. National Vulnerability Database (NVD). CVSS v4.0 is the current FIRST specification. A v3.1 vector string starts with CVSS:3.1/; a v4.0 vector starts with CVSS:4.0/. Testers must read which vector the scanner or advisory used. You cannot treat a 9.8 from one version as interchangeable with a 9.8 from the other as if they shared one formula. This guide will not walk a made-up metric calculation; on the exam you consume a published Base score and interpret it as severity, not as exploit likelihood.

Qualitative labels you will see on many v3.1 publications (FIRST's published bands) are None 0.0, Low 0.1–3.9, Medium 4.0–6.9, High 7.0–8.9, and Critical 9.0–10.0. Those labels still describe severity. A Critical printer is a severe printer bug. It is not a rule that the printer is the first host you attack.

CVE

A CVE is a Common Vulnerabilities and Exposures identifier from the MITRE CVE Program. It names a specific published vulnerability in a product, typically formatted CVE-YYYY-nnnnn. A CVE is a catalog ticket, not a severity score and not a weakness class. Two CVEs can share a CWE and have very different CVSS and EPSS values. NVD often attaches a CVSS vector to a CVE; that does not make NIST the owner of CVE or FIRST the owner of CVE. When a stem gives you a CVE, your 4.1 job is to bind it to a product version you actually validated, then read CVSS and EPSS as separate columns.

CWE

A CWE is a Common Weakness Enumeration — a class of weakness, also catalogued by MITRE. CWE-89 is SQL injection. CWE-79 is cross-site scripting. CWE-798 is use of hard-coded credentials. Many CVEs can map to one CWE. CWE still matters when there is no CVE: a custom payroll app with SQLi is CWE-89 even if MITRE never issued a CVE. On the exam, if the stem asks "what class of weakness is this," the answer is a CWE, not a CVE number and not a CVSS score.

EPSS

The Exploit Prediction Scoring System (EPSS) is also from FIRST. It is a data-driven estimate of the probability that a published CVE will be exploited in the wild in the next 30 days. The score is 0–1 (equivalently 0–100 percent) and is updated daily. Official description: https://www.first.org/epss/.

Memorize the split:

• CVSS Base = severity if exploited
• EPSS = likelihood of exploitation in the near term

A high CVSS with a low EPSS can wait behind a lower-CVSS issue that is already being exploited or that has a high EPSS. EPSS only scores published CVEs. It does not score "admin/admin on the DC" or "TLS 1.0 on the VPN." Those still raise priority through the non-CVE bullets below. An EPSS of 0.85 means a high estimated chance of observed exploitation activity in the next 30 days among issues with that score — not a guarantee, and not a CVSS replacement.

Conditions that raise priority without a CVE

Objective 4.1 does not let you hide behind "there is no CVE." Five named conditions raise priority on their own.

End-of-life (EOL) software and systems. A vendor that no longer ships patches leaves every future bug unfixable. Windows Server 2012 and 2012 R2 reached end of extended support on 10 October 2023. Network gear, TLS stacks, and appliances that cannot leave TLS 1.0 are the same idea. EOL on a domain controller or jump host outranks a fully supported printer with a scary CVE because defenders cannot patch their way out and attackers already know the stack.

Default configurations. Vendor default passwords, default SNMP community public, default cloud storage left public, and default service accounts that were never rotated are often CWE-798-class issues with no CVE. Default credentials on an identity system are a pentest gift and a client emergency. Do not wait for a CVE ID before putting that finding at the top of the attack list.

Running services. Extra listeners expand the attack surface. A DC that also speaks unused FTP, Telnet, or an old management agent is easier to abuse than a DC that only offers the services Active Directory requires. Unnecessary services are a prioritization signal even when each banner is "informational" on a scanner. The question is not "does this port have a CVE?" The question is "does this extra service give me a path to the HVA?"

Vulnerable encryption methods. TLS 1.0 and 1.1, SHA-1 certificates, RC4, 3DES, and export-grade cipher suites are weak crypto. They enable downgrade, forgery, or trivial decryption depending on the protocol. A VPN concentrator or LDAP bind still offering TLS 1.0 is a higher-value crypto finding than a lab printer supporting an old suite on an isolated VLAN. Weak crypto on an identity or remote-access path is an attack-prep signal, not a hygiene footnote.

Defensive capabilities. Ask what will stop you. No EDR, SMB signing disabled, no MFA on the jump host, a flat VLAN, logging turned off — weak defenses raise the chance you can demonstrate impact on that path during the testing window. Strong EDR on a workstation may push you toward a quieter capability in the next section, but it does not make the crown-jewel database low value. Missing defenses on the HVA itself are why a "medium" finding becomes the live fire path.

Worked scenario: lab printer 9.8 versus domain controller 7.5

Two validated findings land on Saturday inside an announced internal test.

Finding P-1. A lab printer on an isolated VLAN has a published CVE. The advisory shows a CVSS Base score of 9.8 (critical band on a v3.1 publication). EPSS is about 0.02 — a low estimated chance of in-the-wild exploitation in the next 30 days. The printer has no domain trust, no stored credentials for other systems, and no path to identity. It is in scope.

Finding D-1. A domain controller has a published CVE with a CVSS Base score of 7.5 (high, not critical). EPSS is about 0.85. The same host still accepts a vendor default administrator password, SMB signing is off, and there is no EDR. Compromising it yields the forest.

Shoot the domain controller first. The printer's 9.8 is intrinsic severity if someone exploits that firmware bug. It does not unlock the business. The DC is the high-value asset; EPSS says exploitation of that CVE is likely; default credentials and missing defenses make a path real today even if you never use the CVE. After the DC, you might still report the printer — you just do not spend the testing window on it first.

Exam trap: sorting the scanner export by CVSS descending and attacking row one. That is scanner administration, not 4.1. Another trap: treating CVE and CWE as synonyms, or treating EPSS as a second severity score you average with CVSS. Keep the columns separate, name the HVA, then pick the path. When you later pick tools and write the attack path for the DC, that is capability selection — the next section.