Which CVSSv3 Attack Vector metric value requires the attacker to physically touch or manipulate the vulnerable component?

The Local attack vector requires the attacker to have a local account or command-line access but does not require physically touching or manipulating the hardware component itself.

CVSSv3 defines the Physical (P) attack vector as requiring the attacker to physically touch or manipulate the vulnerable component - examples include cold boot attacks, hardware implants, or exploiting a device only accessible via direct connection. This is the most restrictive attack vector in the CVSSv3 specification because exploitation cannot be performed remotely or across a network.

The Network attack vector means the component is exploitable from any remote network location with no physical proximity or local access required.

The Adjacent attack vector requires the attacker to share the same network segment or broadcast domain as the target but does not require physical contact with the device.