What these sub-scores mean
Based solely on evidence of default credentials and whether users must change them.
Based solely on how clearly vulnerability disclosures are written.
Based solely on how often known vulnerabilities have been actively exploited.
Based solely on evidence of multi-factor authentication in the vendor's products.
Based solely on how readily vulnerabilities can be patched or mitigated.
Based solely on the average severity of known vulnerabilities.