No. 71: Commission Guidance on the CRA - Placing on the Market
The CRA guidance treats placing on the market differently for standalone software and embedded systems. Longer support periods and workarounds cause higher costs for machine and device manufacturers. It would be simple to treat all products the same.
Read next
How Can Manufacturers Address and Remediate 1000+ CVEs?
Fixing 1000+ CVEs one by one is too costly. Filtering them is arbitrary and might miss important ones. Making the exploitation of hundreds of CVEs unlikely by multiple security measures in one go is nothing else but defence in depth!
Understanding the CVSS Metrics for Exploitability
Instead of fixing hundreds of CVEs, manufacturers can provide enough security measures to make the exploitation unlikely. The decrease of the CVSS metrics is a useful indicator how effective the security measures are. This post is about understanding the CVSS metrics.