CVSS v3.1 Scoring · NIS2 Compliance · Threat Modelling · ARM Cortex-M4
A command-line cybersecurity risk assessment tool for embedded systems, built in Python. The tool performs CVSS v3.1 vulnerability scoring, security control mapping, and NIS2 Article 21 regulatory gap analysis against a modelled ARM Cortex-M4 IoT gateway.
Threat scenarios are based on real vulnerability classes documented in CVE databases and ENISA embedded security guidelines.
Input: Embedded System Threat Register (ARM Cortex-M4 IoT Gateway)
│
▼
CVSS v3.1 Base Score Calculation
│
▼
Security Control Mapping
(Preventive · Detective · Corrective)
│
▼
Risk Exposure Scoring
(CVSS score × control coverage gap)
│
▼
NIS2 Article 21(2) Gap Analysis
│
▼
Colour-Coded Terminal Report
(Tables · Score bars · Summaries)
| ID | Threat | CVSS Score | Severity |
|---|---|---|---|
| R-001 | Remote Code Execution via Ethernet | 9.6 | 🔴 Critical |
| R-003 | Hardcoded Credentials in Firmware | 9.2 | 🔴 Critical |
| R-002 | JTAG Firmware Tampering | 7.6 | 🟠 High |
| R-005 | Privilege Escalation via FreeRTOS Task Isolation | 7.4 | 🟠 High |
| R-004 | Man-in-the-Middle Attack on OTA Firmware Update | 7.1 | 🟠 High |
| R-006 | Unauthorised Access via UART Console | 6.4 | 🟡 Medium |
Average CVSS Score: 7.9 / 10.0
| Result | Detail |
|---|---|
| Coverage | 1 / 8 Article 21(2) requirements (12%) |
| Complete gaps | Incident handling · Business continuity · Supply chain |
| Partial coverage | Cryptography · Vulnerability handling · Access control · Secure comms |
embedded-risk-assessment/
│
├── main.py # Entry point — orchestrates assessment pipeline
├── models.py # Data models, enums & CVSS v3.1 scoring engine
├── risks.py # Risk register — threats, controls & CVSS vectors
├── analysis.py # Control mapping & exposure analysis
├── nis2.py # NIS2 Article 21 gap analysis engine
├── report.py # Colour terminal report generator
└── requirements.txt # Dependencies (colorama, tabulate)
| Area | Detail |
|---|---|
| CVSS v3.1 | Full base score implementation from the official FIRST specification |
| Threat Modelling | ARM/RISC-V embedded system attack surface analysis |
| NIS2 Compliance | Article 21(2) gap identification and remediation mapping |
| Security Engineering | Control mapping, exposure scoring, risk registers |
| Python | Dataclasses, enums, type hints, list comprehensions |
# Clone the repository
git clone https://github.com/MM-Robin/embedded-risk-assessment
cd embedded-risk-assessment
# Create and activate virtual environment
python3 -m venv venv
source venv/bin/activate # Windows: venv\Scripts\activate
# Install dependencies
pip install -r requirements.txt
# Run the assessment
python3 main.py========================================================================
EMBEDDED SYSTEM CYBERSECURITY RISK ASSESSMENT TOOL
CVSS v3.1 | NIS2-Aligned | ARM Cortex-M4 IoT Gateway
Author: Mainuddin Monsur Robin | HAW Hamburg
========================================================================
Risk distribution:
Critical : 2
High : 3
Medium : 1
Avg CVSS score : 7.9 / 10.0
NIS2-relevant : 3 risks
Built as a portfolio project to demonstrate applied cybersecurity knowledge in embedded systems security, regulatory compliance (NIS2), and Python engineering. The threat model targets a realistic ARM Cortex-M4 IoT gateway with Ethernet, JTAG, UART, OTA update, and FreeRTOS-based task isolation.
Mainuddin Monsur Robin M.Sc. Information and Communication Engineering — HAW Hamburg
