A CVE identifier, such as CVE-2021-44228 for the Log4j flaw, is a name everyone agrees on. Advisories, scanners, patch notes and news reports refer to the same entry, and databases such as NIST’s NVD add severity scores and affected version ranges. For an IoT manufacturer, matching the fleet’s SBOM against new CVEs is the routine that turns a disclosure into a patch plan.
Not every flaw gets a CVE, and a CVE in a library does not always mean a product is exploitable; the vulnerable function may never be called. Assessing that, documenting the result and shipping an OTA update when needed is the core of the vulnerability handling that the Cyber Resilience Act and similar rules require manufacturers to perform throughout a product’s support period.
Part of the IoT Glossary. Spotted an error or a missing term? Tell us.