China’s Parallel CVE Systems Expose Alternate Vulnerability Disclosure Timeline

Cybersecurity: China's Dual Vulnerability Databases

China maintains two national vulnerability databases: CNNVD and CNVD. The former is operated under the Ministry of State Security, while the latter is managed by CNCERT as a defender-focused coordination platform. These systems illustrate that vulnerability disclosure is not a singular, global process but rather comprises multiple systems with varying rules and timelines.

Both CNNVD and CNVD catalog software and hardware vulnerabilities, utilizing their own identification systems, schemas, and categorizations, distinct from Western standards such as CWE and CPE. CNNVD often shadows the CVE and NVD databases, and has historically included more entries than these US-maintained datasets at certain times. CNVD, in contrast, is smaller and less consistent in coverage.

Both databases include a CVE field but do not systematically cross-reference each other, complicating the task of correlation and automation for cybersecurity defenders.

China's approach to vulnerability management is governed by the "Provisions on the Management of Network Product Security Vulnerabilities," issued in Jul 2021 and effective from Sep 2021. This regulation requires vendors and operators to report vulnerabilities to authorities, promptly address them, and maintain logs, while also placing conditions on public disclosure. It explicitly restricts the publication of exploit codes, prohibits exaggerating severity, and mandates coordination with state agencies.

Access to both CNNVD and CNVD requires account creation, email verification, and login credentials.

Research indicates that CNNVD contains a subset of entries without CVE mapping, numbering around ten thousand out of over a hundred thousand total vulnerabilities. Compared to CVE and NVD, which provide structured data like CVSS and CWE, the Chinese databases offer simpler categorical severity and free-text descriptions.

Some vulnerabilities appear in CNNVD and CNVD months before being recorded in CVE or NVD. CNVD includes two additional fields: open and submission times, which indicate when a vulnerability was first submitted and when it was published. In some cases, Chinese entries have been identified that do not have a corresponding public CVE or relate to products with little presence in Western markets.

The 2021 regulations have influenced the publication timing and content, especially for entries lacking CVE mappings. Quality issues such as malformed CVE identifiers, inconsistent dates, and misaligned severity scores have been reported in CNVD and CNNVD feeds. Researchers have noted changes in the rate of non-CVE vulnerability exposure around the policy date, suggesting increased state control over public vulnerability information.

For cybersecurity defenders and analysts, relying solely on CVE and NVD may result in missing context and region-specific exposures first documented in foreign databases like CNNVD and CNVD. Western infrastructure offers more machine-readable and transparent data than what is officially available from China, particularly concerning CVSS, CWE, and derived frameworks like KEV lists.

The advantage lies with teams capable of integrating these diverse feeds, normalizing their inconsistencies, and understanding the gaps between them.

Based on reporting by GBHackers.