## ***🧮 CVSS Scoring***

This document summarizes the CVSS v4.0 base scoring for a DoS vulnerability affecting Easy Grade Pro for Windows ≤ 4.0, reported in 2025.



---
---
---



### ***🔐 CVSS Vector***

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:L/IR:L/AR:M/MAV:L/MAC:L/MAT:N/MPR:N/MUI:P/MVC:N/MVI:N/MVA:H/MSC:N/MSI:N/MSA:N/S:N/AU:Y/R:A/V:D/RE:L/U:Clear



---
---
---



### ***🔍 Full CVSS v4.0 Metrics Explanation***

#### ***🧱 Base Metrics***

| Group                        | Metric                            | Value                | Explanation                                                                                                                     |
|------------------------------|-----------------------------------|----------------------|---------------------------------------------------------------------------------------------------------------------------------|
| Exploitability Metrics       | Attack Vector (AV)                | Local (L)            | The vulnerability is triggered by opening a crafted .egp gradebook file locally.                                                |
|                              | Attack Complexity (AC)            | Low (L)              | Exploitation only requires crafting a file with specific field lengths at known offsets.                                        |
|                              | Attack Requirements (AT)          | None (N)             | No additional conditions (such as prior system state manipulation) are required.                                                |
|                              | Privileges Required (PR)          | None (N)             | The attacker does not require any privileges beyond local file access.                                                          |
|                              | User Interaction (UI)             | Passive (P)          | The user must open the crafted .EGP file, but no further interaction is required.                                               |
| System Impact Metrics        | Confidentiality (VC)              | None (N)             | Although an out-of-bounds read occurs, no controlled memory disclosure or sensitive data leakage was observed.                  |
|                              | Integrity (VI)                    | None (N)             | The vulnerability does not allow modification of application memory or data in a controlled manner.                             |
|                              | Availability (VA)                 | High (H)             | Opening the crafted file reliably triggers an unhandled access violation, causing a full application crash (Denial of Service). |
| Subsequent System Impact     | Confidentiality (SC)              | None (N)             | No downstream or dependent systems are affected.                                                                                |
|                              | Integrity (SI)                    | None (N)             | No impact beyond the crashing process.                                                                                          |
|                              | Availability (SA)                 | None (N)             | The impact is limited to the Easy Grade Pro application instance.                                                               |

#### ***🧩 Supplemental Metrics***

| Group                        | Metric                            | Value                | Explanation                                                                                                                                               |
|------------------------------|-----------------------------------|----------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------|
| Supplemental Metrics         | Safety (S)                        | Negligible (N)       | The vulnerability affects an educational desktop application and has no impact on physical safety, human life, or industrial control systems.             |
|                              | Automatable (AU)                  | Yes (Y)              | Crafting the malformed .EGP file is fully automatable. A script can reliably generate files that trigger the crash without manual interaction.            |
|                              | Recovery (R)                      | Automatic (A)        | Recovery simply requires restarting the Easy Grade Pro application. No system reboot, data restoration, or manual cleanup is required.                    |
|                              | Value Density (V)                 | Diffuse (D)          | The affected application typically processes local gradebook data with limited sensitivity. There is no aggregation of high-value secrets or credentials. |
|                              | Vulnerability Response Effort (RE)| Low (L)              | Identifying the issue is straightforward with debugging tools, and mitigation conceptually requires basic bounds checking and validation.                 |
|                              | Provider Urgency (U)              | Clear                | The product is end-of-life and the vendor appears inactive. No coordinated response timeline or emergency remediation is required.                        |

#### ***🌍 Environmental Metrics (Modified Base Metrics)***

| Group                        | Metric                            | Value                | Explanation                                                                                                                             |
|------------------------------|-----------------------------------|----------------------|-----------------------------------------------------------------------------------------------------------------------------------------|
| Exploitability Metrics       | Modified AV (MAV)                 | Local (L)            | Exploitation requires a local user to open a specially crafted .EGP file on the target system. There is no network-based attack vector. |
|                              | Modified AC (MAC)                 | Low (L)              | No special runtime conditions or race conditions are required. The malformed file reliably triggers the crash when parsed.              |
|                              | Modified AT (MAT)                 | None (N)             | No additional environmental or configuration requirements are needed beyond opening the file.                                           |
|                              | Modified PR (MPR)                 | None (N)             | The application runs in the context of the current user. No elevated privileges are required to trigger the vulnerability.              |
|                              | Modified UI (MUI)                 | Passive (P)          | User interaction is required, as the victim must manually open the crafted .EGP file using Easy Grade Pro.                              |
| System Impact Metrics        | Modified VC (MVC)                 | None (N)             | No sensitive information is disclosed. The vulnerability only causes an invalid memory read leading to a crash.                         |
|                              | Modified VI (MVI)                 | None (N)             | The vulnerability does not allow modification of application data or persistent state beyond process termination.                       |
|                              | Modified VA (MVA)                 | High (H)             | Successful exploitation causes the Easy Grade Pro application to crash, fully interrupting its availability for the user session.       |
| Subsequent System Impact     | Modified SC (MSC)                 | Negligible (N)       | The issue does not affect other systems, processes, or users beyond the vulnerable application itself.                                  |
|                              | Modified SI (MSI)                 | Negligible (N)       | There is no impact on the integrity of downstream systems or shared resources.                                                          |
|                              | Modified SA (MSA)                 | Negligible (N)       | The crash is isolated to the Easy Grade Pro process and does not impact system-wide availability.                                       |

#### ***🔧 Environmental – Security Requirements***

| Group                        | Metric                            | Value                | Explanation                                                                                                                              |
|------------------------------|-----------------------------------|----------------------|------------------------------------------------------------------------------------------------------------------------------------------|
| Security Requirements        | Confidentiality Requirement (CR)  | Low (L)              | Easy Grade Pro processes local academic records. While grades are personal data, the vulnerability does not expose or leak information.  |
|                              | Integrity Requirement (IR)        | Low (L)              | The vulnerability does not allow modification or corruption of gradebook data. Integrity impact is minimal in the affected environments. |
|                              | Availability Requirement (AR)     | Medium (M)           | Availability is moderately impacted, as a crash prevents teachers from accessing the affected gradebook. While the issue is limited to local usage and does not affect the operating system or other users, the malformed .EGP file becomes unusable within the application, requiring recovery from backup or recreation of the gradebook. |

#### ***⚠️ Threat Metrics***

| Group                        | Metric                            | Value                | Explanation                                                                                                                                                 |
|------------------------------|-----------------------------------|----------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Threat Metrics               | Exploit Maturity (E)              | POC (P)              | A working proof-of-concept exists demonstrating reliable application crashes by opening a malformed .EGP file. No active exploitation in the wild is known. |



---
---
---



### ***🎯 Final Score***

4.2 / Medium
