Embedded Internet of Things (IoT) devices have become integral to modern operations, driving automation across industries from healthcare to smart manufacturing. Despite their critical importance, these embedded devices are inherently resource-constrained and frequently lack robust, built-in security controls, making them highly attractive targets for cyberattacks. Adversaries continually exploit embedded IoT infrastructure to establish widespread botnets, execute disruptive denial-of-service attacks, or pivot deeper into corporate IT networks.

To prioritize and mitigate these vulnerabilities, security professionals rely on comprehensive vulnerability databases. The Common Vulnerabilities and Exposures (CVE) catalog provides standardized identifiers for publicly known cybersecurity vulnerabilities. However, because severity alone does not equate to active threat, the Exploit Prediction Scoring System (EPSS) complements the CVE framework by estimating the real-world probability that a specific vulnerability will actually be exploited in the wild.   

The task of the student is to analyze the EPSS database with respect to data about embedded IoT devices. The results of the student’s analysis should reveal how exploitable IoT devices are and how their exploitability compare to traditional IT systems.

Tasks to be performed by the student will include:

- Present the Common Vulnerabilities and Exposures (CVE) and Exploit Prediction Scoring System (EPSS) databases
- Design an AI-assisted methodology to automatically filter records relevant for embedded IoT devices from the CVE database
- Apply the designed methodology to filter relevant CVE records created between 2020-2025 and extract the corresponding EPSS scores
- Discuss the exploitability of embedded IoT devices based on the extracted data, comparing the results to traditional IT systems’ exploitability as well