Catch me if you can: an in-depth study of CVE discovery time and inconsistencies for managing risks in critical infrastructures

Research output: Chapter in Book/Report/Conference proceedingConference contribution


  • Joseph Gardiner
  • Emmanouil Samanis
  • Joshua Perrett
  • Awais Rashid

Colleges, School and Institutes

External organisations

  • University of Birmingham
  • University of Bristol


Industrial Control Systems (ICS) are central to the operation of critical national infrastructure (CNI) such as oil and gas, water treatment, power generation and transport systems. Effective risk management to mitigate large-scale disruption to societies and economies depends on both timely information about vulnerabilities and the consistency of this information. The longer the vulnerabilities remain "in the wild" or a lack of consistency in vulnerability reporting, the greater the impact on CNI operators' ability to systematically understand and mitigate the risks. In this paper, we focus on vulnerabilities identified and reported in Siemens ICS devices, which hold the largest share of the market. We undertake an in-depth analysis of 207 CVEs, identifying the time over which vulnerabilities were 'in the wild' before being discovered and advisories issued, and examine issues with the correctness of CVE information. We find that, on average, a vulnerability is 'in the wild' for 5.3 years, and that many CVEs do not correctly reflect and state the affected devices as Common Platform Enumerations (CPEs). Based on our findings, we propose a set of guidelines to improve the reporting and consistency of ICS CVE information.


Original languageEnglish
Title of host publicationCPSIOTSEC'20
Subtitle of host publicationProceedings of the 2020 Joint Workshop on CPS&IoT Security and Privacy
Publication statusPublished - 9 Nov 2020
EventCPSIOTSec: The Joint Workshop on CPS & IoT Security and Privacy -
Duration: 9 Nov 20209 Nov 2020


ConferenceCPSIOTSec: The Joint Workshop on CPS & IoT Security and Privacy