  Security metrics are not standardized, but inter-national proposals such as
the Common Vulnerability ScoringSystem (CVSS) for quantifying the severity of
known vulnerabil-ities are widely used. Many CVSS aggregation mechanisms
havebeen proposed in the literature. Nevertheless, factors related tothe
context of the System Under Test (SUT) are not taken intoaccount in the
aggregation process; vulnerabilities that in theoryaffect the SUT, but are not
exploitable in reality. We propose aCVSS aggregation algorithm that integrates
information aboutthe functionality disruption of the SUT, exploitation
difficulty,existence of exploits, and the context where the SUT operates.The
aggregation algorithm was applied to OpenPLC V3, showingthat it is capable of
filtering out vulnerabilities that cannot beexploited in the real conditions of
deployment of the particularsystem. Finally, because of the nature of the
proposed algorithm,the result can be interpreted in the same way as a normal
CVSS.

Cryptography and Security;Software Engineering