CVE Monitoring automatically matches published Common Vulnerabilities & Exposures (CVEs) vulnerabilities to devices already in your Auvik network inventory. It helps you reduce manual investigation, identify devices that may be affected by a CVE, prioritize investigation, and make informed remediation decisions.
With CVE Monitoring, you can:
- Get an overview of potential device vulnerabilities for a specific site or across multiple sites.
- Prioritize investigation using CVSS severity and known-exploitation information.
- Identify the devices potentially affected by a CVE.
- Drill in on a specific device to determine whether remediation is required.
- Export a custom-branded Device Vulnerabilities Report as a PDF.
Note: CVE Monitoring is available with Auvik Network Management Performance and Advanced subscriptions.
Prerequisites
To use CVE Monitoring:
- Your Auvik subscription must include the Performance or Advanced tier.
- Your user role must include the CVE Monitoring permission.
- Devices must have sufficient inventory data available in Auvik. Providing device credentials helps Auvik collect the vendor, model, firmware, and operating-system information used for matching CVEs to Devices.
How CVE Monitoring works
Auvik retrieves vulnerability records from third-party sources and compares the information in each vulnerability record with available device inventory data, including:
- Vendor
- Make/model
- Firmware version
- OS version
- Description (which often includes Firmware & Software versions)
A match indicates that a device may be affected based on the information available in the vulnerability record and the Auvik inventory. It does not confirm that the device is exploitable or compromised.
CVE Monitoring requires device version information to create a match. If Auvik cannot determine the device’s firmware or operating-system version, the feature will not match that device to a CVE.
Match confidence
Auvik assigns a confidence level to each matched device based on the information used to create the match.
A High confidence match means the vendor, make, and version matched the information in the CVE record.
Match confidence helps you assess the strength of the available information. You should still review the vulnerability details, device configuration, and vendor guidance before deciding how to respond.
The quality of a match depends on the information available from both sources:
- The CVE record must contain accurate and sufficiently detailed product information.
- Auvik must have enough device inventory data to identify the vendor, model, firmware, or operating-system version.
Missing or incomplete information can result in a match that requires further validation or prevent a relevant match from being identified.
CVSS severity
The Common Vulnerability Scoring System, or CVSS, communicates the technical severity of a vulnerability using a score from 0.0 to 10.0.
When multiple scores exist, the Device Vulnerabilities table displays the highest score available from the most recent CVSS version. The CVE details display the available scores from all sources and CVSS versions.
CVSS describes technical severity, but it does not determine the risk to your organization on its own. Consider the device’s exposure, configuration, business importance, and existing security controls when prioritizing your response.
Known Exploited Vulnerabilities
A Known Exploited Vulnerability, or KEV, is a publicly disclosed vulnerability confirmed to have been exploited in real-world attacks.
The U.S. Cybersecurity and Infrastructure Security Agency maintains the Known Exploited Vulnerabilities Catalog. CVE Monitoring identifies vulnerabilities included in this catalog so you can use known exploitation as an additional prioritization signal.
A KEV designation does not replace investigation. Consider the affected device, its configuration, exposure, and available vendor mitigations when deciding what to address first.
How to use CVE Monitoring
Open the Device Vulnerabilities list
Review and filter the CVE list
The Device Vulnerabilities list shows the CVEs matched to devices within the selected site or group of sites.
The list includes:
- CVE ID.
- CVSS score and severity.
- Number of matched devices.
- Known Exploited Vulnerability status.
- Vulnerability description.
Use severity and KEV status to identify vulnerabilities that may require prompt investigation. These values should be considered alongside the importance, exposure, and configuration of the matched devices.
View CVE details and matched devices
Open a CVE to review its details and see the devices that Auvik matched to it.
The CVE details include:
- The CVE description.
- Publication and modification dates.
- Known Exploited Vulnerability status.
- Available CVSS scores.
- Link to the CVE record on the NIST website.
-
The devices matched to the CVE, including
- Device Name
- Device Type
- Site Name
- Vendor
- Model
- Serial Number
- Firmware Version
- Software Version
- Match Confidence
Review the match confidence and device information to determine whether further investigation is required.
Investigate a matched device
From the list of matched devices, go to the device in Auvik to review the available inventory and configuration information.
During your investigation, you may:
- Confirm the device vendor, model, firmware, and operating-system version.
- Review the device’s stored configuration.
- Compare the device information with the CVE record and vendor advisory.
- Use a Remote Terminal session when additional investigation is necessary and permitted.
CVE Monitoring does not recommend or perform remediation. Consult the device vendor’s guidance and follow your organization’s change-management process before changing a configuration, upgrading firmware, or upgrading an operating system.
Export a Device Vulnerabilities Report
The Device Vulnerabilities Report provides a PDF summary of vulnerability information and matched devices.
Reports use the custom branding already configured in your Auvik account.
The report can support conversations about current exposure, investigation priorities, and remediation work. It does not confirm that every matched device is exploitable, that remediation has been completed, or that a compliance requirement has been met.
The report includes a generation datestamp, which indicates when the report was created, not necessarily when the underlying vulnerability information was last updated.
To generate a Device Vulnerabilities Report:
- Go to Documentation -> Reports from any Multi-Site
- Find Device Vulnerabilities and choose Manage
- Enter a Title, Prepared For, and Created By
- Optionally filter the report content by Sites, Device properties, and CVE properties
- Click Save to generate the Report
- Click Export PDF to export the Report as a PDF
Best practices
- Provide device credentials. Complete device information improves Auvik’s ability to match vulnerability records accurately.
- Validate each match. Review the device details, stored configuration, CVE record, and vendor advisory before choosing a response.
- Follow vendor guidance. Use the affected vendor’s instructions to determine the appropriate mitigation or remediation.
For frequently asked questions, click here.