TLDR Tech / InfoSec
Red Vulns Rising: Examining Chinese National Vulnerability Databases
Bitsight analyzed China's two national vulnerability databases—CNNVD, overseen by the Ministry of State Security, and CNVD, operated by CNCERT—and found that while they largely mirror CVE publication, approximately 1,400 entries were published in Chinese databases before becoming public in CVE, often by several months. China's 2021 RMSV regulations tightened domestic vulnerability disclosure controls, including mandatory 48-hour reporting to the government and prohibitions on sharing PoC exploits. There was a notable decline in non-CVE vulnerability publications from CNVD after the regulation, although CNNVD has recently seen a resurgence. Security leaders should account for potential blind spots in Western vulnerability ecosystems, as some Chinese database entries lack CVE equivalents and may represent vulnerabilities unknown to Western defenders.
Read the full story