Step 3: Record the CVSS base score and vector string

I found the CVSS score and vector string listed on the page:

Step 4: Break down the vector string

I went through the vector string piece by piece to see what each part actually meant:

• Attack Vector - Network
• Attack Complexity - Low
• Privileges Required - Low
• User Interaction - None
• Scope - Unchanged
• Confidentiality - High
• Integrity - High
• Availability - High

This one requires a small amount of privilege to exploit (unlike ProxyLogon, which needed none), but it still doesn't need any user interaction, and a successful attack still fully compromises confidentiality, integrity, and availability. That combination is a big part of why EternalBlue was so dangerous once it was paired with a self-spreading worm like WannaCry.

Step 5: Find the CWE category

I checked the Weakness Enumeration section on the NVD page for this CVE, but no CWE was listed for it.

Step 6: Answer a risk question

I considered whether I'd treat this as higher or lower risk under two different scenarios.

Scenario 1: The vulnerable software is live and reachable. Higher risk. This vulnerability lets an attacker remotely access the server, run code, and access files.

Scenario 2: The vulnerable software is installed on a machine that's powered off and not reachable. Lower risk. With no power or network connection, there's no way for an attacker to actually reach the server to exploit the vulnerability in the first place.

Conclusion

Comparing this to the ProxyLogon triage, it's a good example of how two critical vulnerabilities can still differ in the details, EternalBlue needs low privileges where ProxyLogon needed none, but both still land in the "treat as high risk" category once you look at how much damage a successful exploit could do. Just like before, actual risk still comes down to context: the same vulnerability is far less dangerous on a machine that's offline and unreachable.