Vulnerability matching

Where the data comes from, how a CVE is matched to a device, and how the recommended upgrade is chosen.

Sources

Retivo pulls two public sources every day:

NVD (the US National Vulnerability Database): CVEs with their severity score and the affected version ranges of each operating system.
CISA Known Exploited Vulnerabilities: CVEs that are being exploited in the wild.

End of support dates come from endoflife.date.

Matching

Each device has a platform and an OS version (read over SNMP, over SSH or during the first backup). Retivo compares the version with the version ranges NVD lists for that operating system. A CVE matches when the running version falls inside a vulnerable range.

Note

Matching uses the OS version only. It does not check the hardware model or whether the affected feature is turned on, so some matches will not apply to a particular device. Treat the list as the place to start, and read the CVE before you schedule work.

Severity and "exploited"

Severity is the CVSS base score from NVD: Critical (9.0 to 10), High (7.0 to 8.9), Medium (4.0 to 6.9) and Low. A CVE that is on the CISA list is marked Exploited in the wild. Fix those first.

Recommended upgrade

For each device Retivo shows the lowest release that clears every CVE it has matched for that device. If NVD lists no fixed version for one of them, Retivo says so instead of guessing.