Actions
Forum Thread Details
  • State Not Answered
  • Replies 4 replies
  • Subscribers 474 subscribers
  • Views 195 views
  • Users 0 members are here
Related

How do you decide which CVEs actually matter in embedded products?

micheal.embedded

In embedded products, patching every CVE often isn’t realistic due to certification, long test cycles, limited update windows, or system stability risks.

I’m curious how others handle this in practice. When a CVE affects a component in your system, what factors determine whether it gets patched immediately, deferred, or accepted as risk?

Do you prioritize based on exploitability, attack surface, physical access assumptions, update cost, or something else?

Parents
  • 0

    Great question. Everything needs planning but common sense should still prevail.

    Wasn't it Warren Buffett who once said "It takes 20 years to build a reputation and five minutes to ruin it. If you think about that, you'll do things differently."

    Hence be proactive. Trying to recover from the scenario where someone finds a critical bug that you've been ignoring, or worse, trying to hide and it's generally tickets.

    The goal isn't to have zero CVEs (which is impossible); it's to try to have zero surprises.

Reply
  • 0

    Great question. Everything needs planning but common sense should still prevail.

    Wasn't it Warren Buffett who once said "It takes 20 years to build a reputation and five minutes to ruin it. If you think about that, you'll do things differently."

    Hence be proactive. Trying to recover from the scenario where someone finds a critical bug that you've been ignoring, or worse, trying to hide and it's generally tickets.

    The goal isn't to have zero CVEs (which is impossible); it's to try to have zero surprises.

Children
No Data