What is the CVSS v3.1 Medium Severity Range?

312-50v13 By islever Editorial Last updated

Vulnerability Analysis

Short answer

D The medium vulnerability range in CVSS v3.1 is 4.0 to 6.9.

Question

In the Common Vulnerability Scoring System (CVSS) v3.1 severity ratings, what range does medium vulnerability fall in?
  1. 4.0-6.0
  2. 3.9-6.9
  3. 3.0-6.9
  4. 4.0-6.9 Correct Answer

Key Takeaways

The CVSS v3.1 severity rating scale is tested, specifically identifying the numerical range for medium vulnerabilities, where the common trap is confusing the upper or lower bounds.

In the Common Vulnerability Scoring System (CVSS) v3.1, medium severity vulnerabilities are assigned specific numerical scores. This page establishes the correct range for the medium severity rating.

Common mistake: Choosing option A (4.0-6.0) is the most common mistake, likely due to confusing the CVSS v3.1 bounds with an older version or misremembering the upper limit.

Expert Analysis

Why the Answer Is Correct

Option D is correct because the official CVSS v3.1 specification explicitly defines the Medium severity rating as scores ranging from 4.0 to 6.9. This scale ensures a clear distribution of vulnerability impacts across the 0.0 to 10.0 spectrum. Any base score calculated within these bounds is categorized as a medium risk.

Why the Other Options Are Wrong

Option A is incorrect because it cuts off the upper bound at 6.0, excluding valid medium scores from 6.1 to 6.9. Option B is wrong because a score of 3.9 falls into the Low category, not Medium. Option C is incorrect as it extends the lower bound down to 3.0, overlapping with the Low severity rating which ends at 3.9.

Community Comment Notes

As killwitch noted, the official CVSS v3.1 classification clearly places "Medium: 4.0 - 6.9". NikoTomas also confirmed this range and provided the NIST NVD reference link. Dogeo mistakenly claimed the range was "4.0-6.0", which aligns with the incorrect option A.

Official Reference

https://nvd.nist.gov/vuln-metrics/cvss

This link opens the official vendor documentation in a new tab.

Exam Strategy

Memorize the exact numerical boundaries for the CVSS v3.1 severity ratings (None, Low, Medium, High, Critical) as they are strictly defined. Pay special attention to the transition points like 3.9 to 4.0 and 6.9 to 7.0 to avoid off-by-one or decimal boundary errors.

Community Votes

D
75%
A
25%

75% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 3 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 3

  1. NikoTomas 👍 2 Answered D
    Correct is D (4.0 - 6.9) Severity maping table for particular CVSS versions: https://nvd.nist.gov/vuln-metrics/cvss
  2. killwitch 👍 1 Answered D
    In the Common Vulnerability Scoring System (CVSS) v3.1, the severity ratings are classified as follows: None: 0.0 Low: 0.1 - 3.9 Medium: 4.0 - 6.9 High: 7.0 - 8.9 Critical: 9.0 - 10.0
  3. Dogeo 👍 1 Answered A
    The Medium severity rating in CVSS v3.1 applies to vulnerabilities with a score in the range of 4.0-6.0.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Agent-Based vs Network-Based Vulnerability Scanners

S-grade

Network Sniffing Techniques for Penetration Testing

S-grade

File-less Malware Bypassing Application Whitelisting

S-grade

SQL Injection Bypass in Login Forms

S-grade

← Back to 312-50v13 Study Guide