A vulnerability analyst is reviewing a newly disclosed flaw in a public-facing web application. The flaw can be triggered by any remote attacker sending a crafted HTTP request over the internet, without any authentication and without any user interaction. When completing the CVSS v3.1 base metrics for this finding, which value should the analyst assign to the Attack Vector (AV) metric?