I should have made a 2026 issue for my insecurity appliance bingo. With another column: "CVSS sandbagging". However, I think they are actually right here, because the flaw only affects subsequent systems. I would have gone for SC:N/SI:H/SA:H though, upping the score to 2.7
This shows again how bad CVSS performs as a threat metric.