What is a CVE?
A CVE (Common Vulnerabilities and Exposures) is a unique identification number for a publicly known cybersecurity vulnerability. Each CVE is assigned through the CVE Program, operated by MITRE, and provides a standard way to reference and discuss the same vulnerability across different tools, vendors and security advisories.
A CVE does not provide full technical details or a fix. It is a reference ID that helps everyone refer to the same vulnerability.
Why are CVEs important?
CVEs help vendors, security teams and asset owners speak a common language about vulnerabilities. They make it easier to:
- Find and track vulnerabilities in products you use
- Get consistent information from different sources
- Prioritize and manage risks (e.g., using CVSS scores)
- Apply patches and mitigations
- Use in compliance and security reporting
How to read a CVE record
A CVE record contains key information about the vulnerability, affected products and references to more details. Below is an example and explanation of the main fields.
CVE-2011-20001
A vulnerability in the web server interface of Siemens SIMATIC S7-1200 CPUs allows an unauthenticated remote attacker to force the device into a stop/defect state, causing a denial of service condition.
- CVSS Score
- 7.5 (High)
- Affected Products
- Siemens SIMATIC S7-1200 CPU V1 and V2 families (FW < V2.0.3)
- Vulnerability Type
- Denial of Service (DoS)
- Reference
- Siemens Security Advisory NVD Entry
Unique identification number for the vulnerability
Short summary of the vulnerability
Severity rating based on CVSS
Products and versions affected
Links to detailed information and fixes
Key fields in a CVE record
| Field | What it means | Example (CVE-2011-20001) |
|---|---|---|
| CVE ID | Unique number for the vulnerability | CVE-2011-20001 |
| Description | Short summary of the issue | DoS in the web server interface |
| Affected Products | Vendor, product and version details | Siemens SIMATIC S7-1200 CPU V1 and V2 families (FW < V2.0.3) |
| CVSS Score | Severity rating (0.0 – 10.0) | 7.5 (High) |
| Vulnerability Type | Type of vulnerability (e.g., DoS, RCE) | Denial of Service (DoS) |
| References | Links to advisories, technical details and fixes | Siemens Security Advisory, NVD Entry |
| Published Date | When the CVE was publicly released |
Note: the year in a CVE ID does not always match the year it was published. CVE-2011-20001 was published in 2025.
Where to find CVE information
You can look up CVE details from trusted sources:
- CVE Program (MITRE) – https://www.cve.org/
- NIST National Vulnerability Database (NVD) – https://nvd.nist.gov/
- Vendor security advisories – e.g., Siemens, Rockwell, Schneider Electric
Key takeaways
- A CVE is a unique ID for a known cybersecurity vulnerability.
- It helps everyone refer to the same issue across tools and organizations.
- Use the CVE record to understand the affected products, severity and references for more details and fixes.
DTSecLabs / Industrial cybersecurity knowledge
Educational resource | Published Oct 28, 2025