Vulnerability missing on portal

[nader862010]

Hello, 

I’ve been using SNTC portal to check on vulnerabilities of our equipment. On the portal, I do not see any vulnerabilities on 4500 series switch with the IOS version of 3.7.2E.

However, on Cisco software checker, I see bunch of vulnerabilities on the list for IOS version of 3.7.2E (see the attached spreadsheet)

I verified that CSPC has successfully collected and uploaded switch info to portal. 

Can anyone advise why there's mismatch/missing vulnerabilities on the portal?

Thank you

[Chris Camplejohn]

The portal checks more than just SW release. It also checks running configuration and product family/product ID. It may be possible that your code has the vulnerability but your configuration is not vulnerable.

[nader862010]

Does this mean switch can be vulnerable again if there's change in configuration? I still don't understand that there's a mismatch. I don't see any option to fix this on portal.

[Chris Camplejohn]

Yes.  Changing the configuration could make you vulnerable to a Security Advisory.  Is your 4500 running VSS by chance?

[nader862010]

Yes they are running VSS.

[Suchita Shewale]

@nader862010 I believe Austin Testut has internal discussion open on this topic as well. Initially we thought we had a bug with profiling of 4500 switch in this case, upon further analysis that does not seem to be an issue.

Please allow us some time to troubleshoot this more and I will get back with the update.

[atestut]

Hello all, it looks like there is a similar issue where the SNTC Portal is showing more PSIRTs for Nexus 5000's than in the IOS checker for 7.3(3)N1(1) and 7.3(0)N1(1).  @Suchita Shewale I have sent you the excel files via the internal case. 
Perhaps there is the same reason behind both of these PID's having differences in PSIRT totals?

[Chris Camplejohn]

Nexus is new to the Software Checker. Note the caveat they have on the tool: "Also note that the tool only contains vulnerability information for NX-OS Software and NX-OS Software in ACI Mode from July, 2019 onward." But in the SNTC portal, there is analysis for further back from that.