Actions
Forum Thread Details
  • State Not Answered
  • Replies 4 replies
  • Subscribers 471 subscribers
  • Views 121 views
  • Users 0 members are here
Related

How do you decide which CVEs actually matter in embedded products?

micheal.embedded

In embedded products, patching every CVE often isn’t realistic due to certification, long test cycles, limited update windows, or system stability risks.

I’m curious how others handle this in practice. When a CVE affects a component in your system, what factors determine whether it gets patched immediately, deferred, or accepted as risk?

Do you prioritize based on exploitability, attack surface, physical access assumptions, update cost, or something else?

Parents
  • 0

    My experience is five years old and may be stale dated.

    Our dev environment conditioned what happened in production. It also made it difficult to know the condition of dev with all the testing.

    Level of exposure was one deciding factor. Yeah sure it is possible but how possible in our environment. Having more than one mind to do the evaluation helped considerably. It help balance the focus of I might get fired if it happens here against we are to good for it to happen here.

Reply
  • 0

    My experience is five years old and may be stale dated.

    Our dev environment conditioned what happened in production. It also made it difficult to know the condition of dev with all the testing.

    Level of exposure was one deciding factor. Yeah sure it is possible but how possible in our environment. Having more than one mind to do the evaluation helped considerably. It help balance the focus of I might get fired if it happens here against we are to good for it to happen here.

Children
No Data