The global threat landscape has become more complex as a result of China's unique vulnerability disclosure ecosystem This article explores vulnerabilities released chinese. . China maintains two distinct databases, the CNVD and CNNVD, which function with different disclosure timelines and priorities than the centralized CVE system utilized globally.
Due to this dual structure, vulnerabilities that are concealed from Western defenders for long periods of time have been able to quietly emerge. Informational asymmetry is the main attack vector in this case; by postponing the public release of vulnerability data, threat actors can take advantage of security flaws in widely used software, such as Microsoft OneDrive, before worldwide patch cycles have a chance to respond. For enterprise security teams that depend on timely data to prioritize remediation, the impact of this disclosure gap is substantial.
There is a window of exposure during which organizations are unaware of active threats when vulnerabilities are released in Chinese databases months before they are listed in the National Vulnerability Database (NVD) of the United States. For example, long before a similar CVE was thoroughly documented globally, a Microsoft OneDrive DLL hijacking vulnerability was identified in Chinese systems. Because of this information lag, attackers can use these "Red Vulns" as weapons against gullible targets, circumventing standard detection procedures and establishing persistence on compromised networks.
Following a thorough examination of the publication timestamps in both ecosystems, Bitsight analysts discovered these differences.
Sample entries for CNNVD and CNVD, respectively (Source: Bitsight) Their study shows that although the CNNVD and the MITRE CVE list are very similar, the CNVD frequently has distinct entries and timelines. CNVD and CNNVD growth since the first publication date (Source: Bitsight) This demonstrates the relative expansion of these databases, demonstrating how the number of vulnerabilities monitored by Chinese authorities has increased to meet international norms. The crucial discovery, however, is not only the volume but also the deliberate delay in the disclosure process, which essentially transforms vulnerability data from a public good into a national security asset.
Delays in Strategic Disclosure The ecosystem's most alarming feature is the deliberate hold-up in disclosing high-severity vulnerability information to the general public.
By successfully hiding the infection mechanism of novel exploits, this persistence strategy deprives global defenders of the Indicators of Compromise (IOCs) required to identify early-stage attacks. Delays of more than a week between the open and submission dates (Source: Bitsight) This illustrates the "arcs of delays" that occur between a vulnerability's submission and public release, highlighting trends in which private information is delayed. Additionally, a sizable portion of CNVD entries do not instantly map to a CVE, resulting in a "shadow" inventory of security vulnerabilities.
Additionally, it highlights this by contrasting severity distributions, demonstrating how risk assessments can vary across national boundaries.
For a more comprehensive threat picture, security teams need to expand their intelligence sources beyond NVD to include these international databases. Vulnerability Name Severity Key Observation CVE-2024-33698 CVE / ID Mapped to CNVD entry, Generic Vulnerability High was later published in CVE. Although it was published earlier, CNVD-2024-xxxxx OneDrive DLL Hijacking High is somewhat similar to CVE-2021-40444.
An example of a "event-based" vulnerability in CNVD is CNVD-202-35587 Bitcoin Core DoS Medium. Establish ZeroOwl as a Preferred Source in Google, and use LinkedIn, X, and CVE-2021-40444 MSHTML RCE Critical as a point of reference for delay analysis.
