How to tell whether a Cisco IOS XE version is affected by a CVE
To tell whether a Cisco IOS XE version is affected by a CVE, match the exact release against the affected releases in Cisco's security advisories, then read each advisory's vulnerable products section, because many apply only when a feature is configured. NacTrack does the first half for every version in your fleet at once and lists the findings per device, with the first fixed release. The second half, the configuration conditions, stays with you.
What you need
- Module required: compliance.
- Permission required: view_audit.
- Devices whose software version was collected; findings come from the CVE synchronisation with the NacTrack authority.
In NacTrack
- 1
Open Security, then CVE Vulnerabilities
The page opens on totals: findings, actively exploited (KEV), critical, high, and affected devices. The By device table ranks devices by exposure, with the highest CVSS and the number of CVEs for each.
Screen: app.nactrack.com/compliance/vulnerabilities
- 2
Search All findings for the version
All findings has one row per device and CVE, with the software and its version, the CVSS, the EPSS, the KEV flag, the Fixed in release and a link to the vendor advisory. Search by CVE, by host or by keyword, filter by severity, or tick KEV only.
Screen: app.nactrack.com/compliance/vulnerabilities
- 3
Open the advisory and read its conditions
Follow the vendor advisory link and read Vulnerable Products. If the advisory applies only when a feature is enabled, check that feature in the device configuration before you treat the finding as exposure.
Screen: app.nactrack.com/compliance/vulnerabilities
By hand, without NacTrack
Cisco's Software Checker takes one or more releases, a text file listing releases, or the output of "show version", and returns the advisories that affect each release with the first fixed release. By default it only includes advisories rated Critical or High; tick Medium to see the rest.
Then read the conditions. For example, the advisory for CVE-2023-20198 and CVE-2023-20273 says they affect IOS XE only if the web UI is enabled, through "ip http server" or "ip http secure-server", and gives "show running-config | include ip http server|secure|active" to check.
What this view does not tell you
- Matching is on the version string alone. Configuration conditions are not evaluated, and SMUs or other patches applied on top of a release are not taken into account: a patched device still shows the findings of its base release.
- Findings arrive through a daily synchronisation with the NacTrack authority, which receives only vendor, OS, version and a device count, never a hostname. If a sync fails, the page says so and shows the findings of the last good run. A device with no collected version gets no CVE data at all.
- Fixed in is shown as the source gives it and is not interpreted. There is no CSV export of the findings; the CVE report under Reporting is a PDF.
Further reading
Network device CVE exposure by exact software version
Which devices a published vulnerability can reach, matched to the exact software version of each one, with its severity and the fixing version.
How-to guideHow to find the end-of-support date of a Cisco Catalyst 2960
End-of-support dates for the Catalyst 2960, 2960-S, 2960-Plus, 2960-X and 2960-XR, read from Cisco's notices, and how to check your own models.
How-to guideHow to audit switch hardening: the checklist
A switch hardening checklist by plane, from Cisco's IOS hardening guide, and how to check it against every collected configuration with the evidence.