Network Configuration Manager (NCM) detects known firmware vulnerabilities (CVEs) and End-of-Life/End-of-Support (EOL/EOS) status for your managed network devices, so you can identify at-risk devices without manually checking vendor advisories.
Firmware vulnerability detection is supported for the following vendors. If your device vendor is not listed, NCM will not report CVEs for it.
| Vendor | ||
|---|---|---|
| Cisco | Juniper | Palo Alto |
| HP | HPE | Aruba |
| Arista | Fortinet | Dell |
| MikroTik | Check Point | F5 |
| Blue Coat | Infoblox | Riverbed |
| Huawei | Netgear | NetScreen |
NCM collects vulnerability data from the National Vulnerability Database (NVD), vendor security advisories, vendor APIs, and vendor JSON/CSAF feeds.
Vulnerability data is collected from the National Vulnerability Database using vendor CPE information.
https://services.nvd.nist.gov/rest/json/cves/2.0?virtualMatchString=cpe:2.3:{part}:{vendor}
| Parameter | Meaning |
|---|---|
| {part} | CPE part identifier — h (hardware), o (operating system), or a (application) |
| {vendor} | CPE vendor string for the target vendor |
The following 17 vendors are processed through NVD:
| Vendor | ||
|---|---|---|
| 3Com | Arista | Blue Coat |
| Check Point | Citrix | CommScope |
| Dell | H3C | Huawei |
| Infoblox | MikroTik | Netgear |
| Nokia | Riverbed | Ruckus |
| Ruckus Wireless | SonicWall | |
These vendors publish vulnerability data through their own APIs, advisories, JSON, or CSAF feeds. NCM does not collect data from NVD for these vendors.
| Vendor | Format | Source |
|---|---|---|
| Aruba | HTML + JSON (CSAF) | https://csaf.arubanetworking.hpe.com/ and HPE Security Bulletin Library |
| Cisco | Cisco PSIRT APIs | https://apix.cisco.com |
| F5 | Security advisories | https://my.f5.com |
| Fortinet | CSAF, crawled per CVE page | https://www.fortiguard.com/psirt |
| Infinxt | API integration | https://cveportal.infinxt.co.in/ |
| Juniper | Security advisories | https://supportportal.juniper.net |
| NEC | Vendor web pages | https://jpn.nec.com/univerge/ix/Support/Security-Info/index.html https://jpn.nec.com/qxseries/vulnerability.html |
| Opengear | Vendor web pages | https://portal.opengear.com/s/knowledgebase |
| Palo Alto Networks | JSON, one file per CVE | https://security.paloaltonetworks.com/json/<CVE-ID> |
| Frequency | Endpoint | Purpose |
|---|---|---|
| Daily | /security/advisories/v2/all/lastpublished | Range API called with a one-week date window |
| Weekend | /security/advisories/v2/cve/<cveid> | Fetch complete CVE details by CVE ID |
| Weekend | /security/advisories/v2/all | Full advisory set |
During the weekend sync, the full advisory set is compared against stored records. Complete CVE details are fetched, invalid records are removed, and newly identified vulnerability records are added.
NCM supports and displays vulnerabilities only from the sources listed above. If a vulnerability is announced through any other source, NCM will not display it.
Network Configuration Manager performs two independent checks on every managed device. They rely on different device attributes, which is why one can work while the other does not.
| Check | Answers the question | Matched using | Needs |
|---|---|---|---|
| Firmware Vulnerability | Is this device running firmware with a known CVE? | OS type + OS version | Backup + valid OS data |
| EOL/EOS | Has this device reached End-of-Life or End-of-Support? | Device model | Backup + valid model |
Complete all three items below before using this feature. Detection will be incomplete if any one of them is missing.
| Prerequisite | Why it is needed |
|---|---|
| The device is actively managed in NCM | NCM only collects data from devices it manages. |
| Each device has been backed up successfully at least once | The backup populates OS type, OS version, and model. |
| The NCM Data Center URL is whitelisted: https://ncm.nimbuspop.com | Without outbound access, your installation cannot download new CVE and EOL data. |
Vulnerability and EOL data flows from public sources to your devices in four stages:
Use either method to confirm that your installation has current vulnerability data.
Option 1 — From the NCM UI (recommended)
Navigate to Firmware Vulnerabilities → Sync Vulnerability DB
Option 2 — From the database
Run the following query:
select * from ncmfirmvulndetails;
Every managed device is placed in one of five EOL categories.
| Status | What it means | Action |
|---|---|---|
| Active | Fully supported by the vendor. No EOL or EOS announcement. | None |
| Announced | The vendor has announced a future EOL date. | Plan the refresh cycle |
| Sale Discontinued | The device is no longer sold, but vendor support is still active. | Plan replacement before support ends |
| Expired | The vendor support period has ended. | Prioritize replacement |
| Unverified | Model information is incomplete or does not match vendor records. | See Troubleshooting |
The Hardware Data Collector runs vendor-specific CLI commands on your managed devices and collects the hardware and software details NCM needs for matching.
It collects series, model, OS type, OS version, and other hardware details required by NCM. The exact commands and fields vary by vendor, device model, and device template.
It runs automatically every day at 6:00 AM. You can also run it on demand while troubleshooting, or after applying a patch, to confirm updated commands and parsing are working.
To share collected data with the NCM team, use the automated email option available for Hardware Collector data, or download the data manually and attach it to your support ticket.
Find your symptom below and go to the matching section.
| Symptom | Most likely cause | Go to |
|---|---|---|
| A CVE you know about is not listed in NCM | Sync failed, or OS data is missing | Scenario A |
| Device details are missing, incorrect, or show [NA]; or details are correct but EOL/vulnerability data is still missing | Hardware Collector data may need review, or the EOL/vulnerability mapping may not be available for that device | Scenario B |
Work through these steps in order before raising a ticket.
Step 1 — Confirm the sync succeeded
Go to Firmware Vulnerabilities → Sync Vulnerability DB, or run select * from ncmfirmvulndetails;. If the sync failed or has not run recently, confirm that https://ncm.nimbuspop.com is reachable from your environment.
Step 2 — Confirm OS type and OS version are populated
Open the affected device and check that both fields have valid values. If either is missing or incorrect, NCM cannot match the device to vulnerability records. Back the device up successfully at least once to populate these details.
Step 3 — Confirm the CVE exists in a supported source
NCM can only report what its sources publish. Check whether the vulnerability appears in the National Vulnerability Database (NVD), the vendor security advisory page, the vendor API, or the vendor JSON/CSAF feed. If the CVE is not yet published in a supported source, it will not appear in NCM.
Step 4 — Raise a support ticket
If all three steps above check out, raise a ticket with the following:
| Attach | Details |
|---|---|
| Device snapshot screenshot | Device name, OS type, OS version, and model as shown in NCM |
| Vulnerability database output | Output of select * from ncmfirmvulndetails; |
| Reference source | URL or screenshot of the vendor/NVD page confirming the vulnerability |
| CVE ID | The CVE ID or advisory ID missing from NCM |
| Affected device details | Device name, vendor, OS type, OS version, and site/environment details if applicable |
This scenario covers two related situations:
NCM first verifies whether the required device details are correctly populated. If any details are missing or invalid, the NCM team reviews the Hardware Collector data to identify why the information is not being populated correctly. Based on this review, the team may provide a patch with the required hardware commands or parser updates.
If the device details are already correct, the NCM team will further verify whether the corresponding EOL/EOS or vulnerability information is available and mapped for that device.
To resolve a Hardware Collector issue:
<OpManager_Home>/conf/ncm/devicemgmt/<OpManager_Home>/conf/ncm/devicemgmt/patchIn an enterprise setup, apply the patch on the Central server only through the Central UI. There is no need to apply it manually on individual Probe servers.
| Stage | If it fails | |
|---|---|---|
| 1 | Device is actively managed | Add the device to NCM management |
| 2 | Configuration backup completed successfully at least once | Resolve the backup failure first |
| 3 | Verify model, series, OS type, and OS version are populated and valid | Go to Scenario B |
| 4 | If details are missing or invalid, review Hardware Collector data and identify command/parser change | Share collector data with the NCM team |
| 5 | Apply patch via Hardware Populator | See Apply a Hardware Collector Patch |
| 6 | Collect hardware data again and verify details | Repeat from stage 4 |
| 7 | NCM uses corrected device details to retrieve EOL/EOS and vulnerability data | If data is still unavailable despite valid details, verify EOL/EOS or vulnerability mapping availability with the NCM team |
A daily synchronization runs at 3:00 AM. It collects data from NVD and vendor sources, updates the NCM Data Center, and then your installation synchronizes the latest data.
Whitelist the NCM Data Center URL in your environment: https://ncm.nimbuspop.com
In the UI, go to Firmware Vulnerabilities → Sync Vulnerability DB. From the database, run select * from ncmfirmvulndetails;
Vulnerability detection matches on OS type and OS version. EOL detection matches on device model. Because they use different attributes, one can work while the other does not.
Yes. Each device must be backed up successfully at least once. NCM uses data collected during backup to identify OS type, OS version, and model. Without it, NCM cannot detect vulnerabilities or EOL status.
Successful management does not guarantee that all hardware information is populated. The device template may not contain the right hardware command, or the device may return output in a format the parser does not currently support. See Scenario B.
A correct model does not guarantee a matching EOL/EOS record exists. The NCM team verifies the device details and checks whether EOL/EOS information is available. See Scenario B.
Vulnerability detection uses device hardware and software information to find applicable records. If that information is incomplete or no corresponding mapping exists, the expected data will not appear. See Scenario B.
It executes vendor-specific CLI commands on managed devices to collect series, model, OS type, OS version, and other hardware information NCM needs.
Primarily for troubleshooting EOL/EOS and vulnerability issues. When device details are wrong or show [NA], the NCM team reviews the collector data to determine why.
It runs automatically every day at 6:00 AM. Manual collection is only needed while troubleshooting, or when the NCM team requests fresh data after a patch.
Use the automated email option for Hardware Collector data, or download the data manually and attach it to your support ticket.
They review it to identify the exact series, model, OS type, and OS version. If the information is not being parsed correctly, they may prepare a patch that adds new hardware CLI commands, updates the parser, or makes other parsing changes.
Found under Settings → Device Management → Hardware Collector (or Settings → NCM → Device Management → Hardware Collector), it applies hardware-related patches provided by the Network Configuration Manager team, resolving parsing issues so that series, model, OS type, and OS version populate correctly.
The updated commands and parser changes are used during the next hardware data collection. Verify that series, model, OS type, and OS version are correct. Once they are, NCM can use them for EOL/EOS and vulnerability retrieval.
No, the patch only updates the commands and parsing logic NCM uses. It does not modify the configuration of the managed device.
No, apply it on the Central server through the Central UI only. Individual Probe servers do not need the patch applied manually.
Collect the latest Hardware Collector data and share it with the NCM team. They will review the new command output and parser behavior to determine whether further changes are required.
Not automatically. NCM uses vendor- and device-specific commands and parsers, and differences between models, firmware versions, and CLI output formats can require additional commands or parser updates. Where supported, the NCM team can provide them.