And CVSS4 has added more metrics - including an AT (Attack Requirements) field:

Are there any conditions necessary for an attack which the attacker cannot influence?

https://nvd.nist.gov/vuln-metrics/cvss/v4-calculator