SNTC vulnerabilities Report Issue

[NestleAM]

I would like to understand how the vulnerability reporting works in SNTC. Lately, I have been noticing something strange. Not sure, if it is a reporting issue or something that I am missing. For instance, the SNTC is reporting the following vulnerability against assets that are at the correct fix version of the OS.

Multiple Vulnerabilities in Cisco IOS XE Software Web UI Feature
Remote Unauthenticated Code Execution Vulnerability in OpenSSH Server (regreSSHion): July 2024

SNTC seeing the correct version of the OS being in place but still reports the asset as vulnerable to the above vulnerability. How can we resolve this?

[salgarin]

Hello team,

Thank you for contacting Cisco and Global CX - Smart Services Support Team. Could you please provide the next details by private message:

• Company name in the SNTC portal.

• Inventory name.

• Company address.

• Customer's CCOID.

• Email.

• Company CR Party ID.

* Impacted devices (Serial number, device name, OS version....)

I will be waiting for the details so that we can check further and advise next steps.

Best regards,

[NestleAM]

Hello - shared the details in PM

[NestleAM]

@salgarin - I have shared the details in private message and anticipating your response sooner.

[NestleAM]

@salgarin @lolivera - awaiting your inputs on the raised query. Thanks!

[NestleAM]

@salgarin @lolivera - I am hoping if you had a chance to review this issue. The devices are having the fixed version installed yet they are reported as vulnerable. 

[adias]

PLease copy the link of the URL notice of the vulnerability here

[NestleAM]

Here I have pasted the links

Multiple Vulnerabilities in Cisco IOS XE Software Web UI Feature

Remote Unauthenticated Code Execution Vulnerability in OpenSSH Server (regreSSHion): July 2024 (cisco.com)

[NestleAM]

Hello @adias any information on the raised queries? We are yet to have any answers. Anticipating a positive response at the earliest.

[NestleAM]

@adias @salgarin @lolivera