MITRE: Funding for critical CVE program ends

MITRE Vice President Yosry Barsoumwarned that US government funding for the Common Vulnerabilities and Exposures (CVE) and Common Weakness Enumeration (CWE) is ending, which could cause widespread disruption to the international cybersecurity.

See also: Critical RCE vulnerability detected in Ivanti VPN devices

CVE, considered the more critical of the two programs, is managed by MITRE with funding from the National Cyber ​​Security Division of the U.S. Department of Homeland Security (DHS). CVE is vital to accuracy, clarity, and the creation of common standards when discussing security vulnerabilities.

The program has wide application in various cybersecurity tools, such as vulnerability management systems, and allows the tracking of all new vulnerabilities through CVE Identifiers (CVE IDs), which are issued by CVE Numbering Authorities (CNAs) around the world, with MITRE acting as CVE Editor and master CNA.

CVE helps avoid the confusion caused by using multiple names for the same security vulnerability, facilitates coordinated cataloging of new vulnerabilities, and allows security teams to share information more easily through announcements, vulnerability databases, and other sources, using a standard system .

See also: Vulnerability in AMD CPUs allows malicious code to be loaded

Since the letter was published online, many experts and leaders in the cybersecurity community have expressed concern. They fear that the program will be abruptly terminated, and that if the servers are shut down and the CVE Numbering Authorities’ access to the CVE API is cut off, the industry will no longer have a standardized way to track new security issues.

According to former CISA head Jean Easterly, the immediate result would likely be the collapse of most trusted security tools and processes, as well as the dismantling of any efforts at global coordination.

Casey Ellis, founder of crowdsourcing security company Bugcrowd, added: "CVE is a cornerstone of much of vulnerability management, incident response, and protection . A sudden service outage can quickly escalate into a serious national security."

See also: Hackers exploit vulnerability in OttoKit WordPress plugin

The importance of the continuous and uninterrupted operation of the CVE system cannot be underestimated, as it is a key tool for identifying and classifying vulnerabilities in software and systems. The slightest interruption in this mechanism could create serious gaps in the security of information infrastructures, leaving governments, organizations and businesses exposed to cyberattacks. In a world increasingly dependent on technology, timely information and response to new vulnerabilities is vital to maintaining national and international security.

Source: bleepingcomputer