Conditional risk assessment based on software vulnerability with CVSS