In reply to Stéphane.

Thank you Stéphane! You highlight one of the reasons why I picked vendor-neutral data (NVD data in this case). A further story may be to do an analysis of how the industry (including vendors like Cisco) score the same vulnerabilities using CVSSv3, once it is more widely adopted.