# Firmware Vulnerability and EOL/EOS Detection - Network Configuration Manager

Network Configuration Manager (NCM) detects known firmware vulnerabilities (CVEs) and [End-of-Life/End-of-Support (EOL/EOS)](https://www.manageengine.com/network-configuration-manager/help/eol.html?help-firmware-vulnerability-and-eol-eos-detection) status for your managed network devices, so you can identify at-risk devices without manually checking vendor advisories.

1. [Supported vendors](https://www.manageengine.com/network-configuration-manager/help/firmware-vulnerability-and-eol-eos-detection.html#supported-vendors)
2. [Data sources](https://www.manageengine.com/network-configuration-manager/help/firmware-vulnerability-and-eol-eos-detection.html#appendix)
3. [What this feature detects](https://www.manageengine.com/network-configuration-manager/help/firmware-vulnerability-and-eol-eos-detection.html#what-detects)
4. [Prerequisites](https://www.manageengine.com/network-configuration-manager/help/firmware-vulnerability-and-eol-eos-detection.html#prerequisites)
5. [How it works](https://www.manageengine.com/network-configuration-manager/help/firmware-vulnerability-and-eol-eos-detection.html#how-it-works)
6. [Checking sync status and EOL status](https://www.manageengine.com/network-configuration-manager/help/firmware-vulnerability-and-eol-eos-detection.html#everyday-use)
7. [Troubleshooting](https://www.manageengine.com/network-configuration-manager/help/firmware-vulnerability-and-eol-eos-detection.html#troubleshooting)
8. [FAQs](https://www.manageengine.com/network-configuration-manager/help/firmware-vulnerability-and-eol-eos-detection.html#faq)

## Supported vendors

[Firmware vulnerability](https://www.manageengine.com/network-configuration-manager/help/firmware-vulnerability-v12.html?help-firmware-vulnerability-and-eol-eos-detection) detection is supported for the following vendors. If your device vendor is not listed, NCM will not report CVEs for it.

| Vendor |  |  |
|---|---|---|
| Cisco | Juniper | Palo Alto |
| HP | HPE | Aruba |
| Arista | Fortinet | Dell |
| MikroTik | Check Point | F5 |
| Blue Coat | Infoblox | Riverbed |
| Huawei | Netgear | NetScreen |

NCM collects vulnerability data from the National Vulnerability Database (NVD), vendor security advisories, vendor APIs, and vendor JSON/CSAF feeds.

## Data sources

### NVD-Based Collection

Vulnerability data is collected from the National Vulnerability Database using vendor CPE information.

`https://services.nvd.nist.gov/rest/json/cves/2.0?virtualMatchString=cpe:2.3:{part}:{vendor}`

| Parameter | Meaning |
|---|---|
| {part} | CPE part identifier — h (hardware), o (operating system), or a (application) |
| {vendor} | CPE vendor string for the target vendor |

The following 17 vendors are processed through NVD:

| Vendor |  |  |
|---|---|---|
| 3Com | Arista | Blue Coat |
| Check Point | Citrix | CommScope |
| Dell | H3C | Huawei |
| Infoblox | MikroTik | Netgear |
| Nokia | Riverbed | Ruckus |
| Ruckus Wireless | SonicWall |  |

### Direct Vendor Sources

These vendors publish vulnerability data through their own APIs, advisories, JSON, or CSAF feeds. **NCM does not collect data from NVD for these vendors.**

| Vendor | Format | Source |
|---|---|---|
| Aruba | HTML + JSON (CSAF) | [https://csaf.arubanetworking.hpe.com/](https://csaf.arubanetworking.hpe.com/) and [HPE Security Bulletin Library](https://support.hpe.com/connect/s/securitybulletinlibrary?language=en_US&archive=false) |
| Cisco | Cisco PSIRT APIs | [https://apix.cisco.com](https://apix.cisco.com) |
| F5 | Security advisories | [https://my.f5.com](https://my.f5.com) |
| Fortinet | CSAF, crawled per CVE page | [https://www.fortiguard.com/psirt](https://www.fortiguard.com/psirt) |
| Infinxt | API integration | [https://cveportal.infinxt.co.in/](https://cveportal.infinxt.co.in/) |
| Juniper | Security advisories | [https://supportportal.juniper.net](https://supportportal.juniper.net) |
| NEC | Vendor web pages | [https://jpn.nec.com/univerge/ix/Support/Security-Info/index.html](https://jpn.nec.com/univerge/ix/Support/Security-Info/index.html)<br>[https://jpn.nec.com/qxseries/vulnerability.html](https://jpn.nec.com/qxseries/vulnerability.html) |
| Opengear | Vendor web pages | [https://portal.opengear.com/s/knowledgebase](https://portal.opengear.com/s/knowledgebase) |
| Palo Alto Networks | JSON, one file per CVE | [https://security.paloaltonetworks.com/json/<CVE-ID>](https://security.paloaltonetworks.com/json/%3CCVE-ID%3E) |

**Note:** Network Configuration Manager collects vendor data in the formats listed above. If a vendor or NVD changes their data format, NCM may not immediately support the new format. CVEs published only in the updated format will not be available in NCM until support for the new format is added.

### Cisco Sync Schedule

| Frequency | Endpoint | Purpose |
|---|---|---|
| Daily | /security/advisories/v2/all/lastpublished | Range API called with a one-week date window |
| Weekend | /security/advisories/v2/cve/<cveid> | Fetch complete CVE details by CVE ID |
| Weekend | /security/advisories/v2/all | Full advisory set |

During the weekend sync, the full advisory set is compared against stored records. Complete CVE details are fetched, invalid records are removed, and newly identified vulnerability records are added.

NCM supports and displays vulnerabilities only from the sources listed above. If a vulnerability is announced through any other source, NCM will not display it.

## What this feature detects

Network Configuration Manager performs two independent checks on every managed device. They rely on different device attributes, which is why one can work while the other does not.

| Check | Answers the question | Matched using | Needs |
|---|---|---|---|
| Firmware Vulnerability | Is this device running firmware with a known CVE? | OS type + OS version | Backup + valid OS data |
| EOL/EOS | Has this device reached End-of-Life or End-of-Support? | Device model | Backup + valid model |

**Note:** If OS type or OS version is blank or incorrect, vulnerability results will be incomplete even though EOL detection still works. If the device model is blank or incorrect, EOL results will be incomplete even though vulnerability detection still works.

## Prerequisites

Complete all three items below before using this feature. Detection will be incomplete if any one of them is missing.

| Prerequisite | Why it is needed |
|---|---|
| The device is actively managed in NCM | NCM only collects data from devices it manages. |
| Each device has been backed up successfully at least once | The backup populates OS type, OS version, and model. |
| The NCM Data Center URL is whitelisted: [https://ncm.nimbuspop.com](https://ncm.nimbuspop.com) | Without outbound access, your installation cannot download new CVE and EOL data. |

**Note:** NCM must reach [https://ncm.nimbuspop.com](https://ncm.nimbuspop.com) without proxy, firewall, or SSL-inspection interference. SSL inspection is a common cause of silent sync failures.

## How it works

Vulnerability and EOL data flows from public sources to your devices in four stages:

1. **Vendors and NVD publish advisories.** NCM collects them from the National Vulnerability Database, vendor security advisories, vendor APIs, and vendor JSON/CSAF feeds.
2. **The NCM Data Center is updated.** A daily synchronization runs at 3:00 AM and refreshes vulnerability and EOL data centrally.
3. **Your NCM installation syncs.** Your installation pulls the latest data from the NCM Data Center. This requires outbound access to the Data Center URL.
4. **NCM matches data to your devices.** Device details collected during backup and by the Hardware Data Collector are compared against the vulnerability and EOL records.

## Checking sync status and EOL status

### Check the Sync Status

Use either method to confirm that your installation has current vulnerability data.

**Option 1 — From the NCM UI (recommended)**

Navigate to **Firmware Vulnerabilities** → **Sync Vulnerability DB**

**Option 2 — From the database**

Run the following query:

`select * from ncmfirmvulndetails;`

### Understand EOL Status

Every managed device is placed in one of five EOL categories.

| Status | What it means | Action |
|---|---|---|
| Active | Fully supported by the vendor. No EOL or EOS announcement. | None |
| Announced | The vendor has announced a future EOL date. | Plan the refresh cycle |
| Sale Discontinued | The device is no longer sold, but vendor support is still active. | Plan replacement before support ends |
| Expired | The vendor support period has ended. | Prioritize replacement |
| Unverified | Model information is incomplete or does not match vendor records. | See [Troubleshooting](https://www.manageengine.com/network-configuration-manager/help/firmware-vulnerability-and-eol-eos-detection.html#troubleshooting) |

### Hardware Data Collector

The Hardware Data Collector runs vendor-specific CLI commands on your managed devices and collects the hardware and software details NCM needs for matching.

It collects series, model, OS type, OS version, and other hardware details required by NCM. The exact commands and fields vary by vendor, device model, and device template.

It runs automatically every day at 6:00 AM. You can also run it on demand while troubleshooting, or after applying a patch, to confirm updated commands and parsing are working.

To share collected data with the NCM team, use the automated email option available for Hardware Collector data, or download the data manually and attach it to your support ticket.

## Troubleshooting

Find your symptom below and go to the matching section.

| Symptom | Most likely cause | Go to |
|---|---|---|
| A CVE you know about is not listed in NCM | Sync failed, or OS data is missing | [Scenario A](https://www.manageengine.com/network-configuration-manager/help/firmware-vulnerability-and-eol-eos-detection.html#scenario-a) |
| Device details are missing, incorrect, or show [NA]; or details are correct but EOL/vulnerability data is still missing | Hardware Collector data may need review, or the EOL/vulnerability mapping may not be available for that device | [Scenario B](https://www.manageengine.com/network-configuration-manager/help/firmware-vulnerability-and-eol-eos-detection.html#scenario-b) |

### Scenario A — An expected vulnerability is not listed

Work through these steps in order before raising a ticket.

**Step 1 — Confirm the sync succeeded**

Go to **Firmware Vulnerabilities** → **Sync Vulnerability DB**, or run `select * from ncmfirmvulndetails;`. If the sync failed or has not run recently, confirm that [https://ncm.nimbuspop.com](https://ncm.nimbuspop.com) is reachable from your environment.

**Step 2 — Confirm OS type and OS version are populated**

Open the affected device and check that both fields have valid values. If either is missing or incorrect, NCM cannot match the device to vulnerability records. Back the device up successfully at least once to populate these details.

**Step 3 — Confirm the CVE exists in a supported source**

NCM can only report what its sources publish. Check whether the vulnerability appears in the National Vulnerability Database (NVD), the vendor security advisory page, the vendor API, or the vendor JSON/CSAF feed. If the CVE is not yet published in a supported source, it will not appear in NCM.

**Step 4 — Raise a support ticket**

If all three steps above check out, raise a ticket with the following:

| Attach | Details |
|---|---|
| Device snapshot screenshot | Device name, OS type, OS version, and model as shown in NCM |
| Vulnerability database output | Output of `select * from ncmfirmvulndetails;` |
| Reference source | URL or screenshot of the vendor/NVD page confirming the vulnerability |
| CVE ID | The CVE ID or advisory ID missing from NCM |
| Affected device details | Device name, vendor, OS type, OS version, and site/environment details if applicable |

### Scenario B — Device details are missing or data is still not available

This scenario covers two related situations:

- Device details such as OS type, OS version (needed for vulnerability detection), or model (needed for EOL detection) are missing, incorrect, or show [NA].
- Device details are correctly populated, but EOL or vulnerability data is still not available.

NCM first verifies whether the required device details are correctly populated. If any details are missing or invalid, the NCM team reviews the Hardware Collector data to identify why the information is not being populated correctly. Based on this review, the team may provide a patch with the required hardware commands or parser updates.

If the device details are already correct, the NCM team will further verify whether the corresponding EOL/EOS or vulnerability information is available and mapped for that device.

To resolve a Hardware Collector issue:

1. Collect the latest Hardware Collector data and share it with the NCM team.
2. Apply the patch you receive—see [Apply a Hardware Collector Patch](https://www.manageengine.com/network-configuration-manager/help/firmware-vulnerability-and-eol-eos-detection.html#apply-patch) below.
3. Run hardware data collection again.
4. Verify that model, series, OS type, and OS version are now correctly populated.

**Note:** If the patch does not resolve the issue, collect the latest Hardware Collector data again and share it with the NCM team for further review.

### Apply a Hardware Collector Patch

1. On the product server, navigate to `<OpManager_Home>/conf/ncm/devicemgmt/`
2. Create a directory named **patch**
3. Place the files provided by the NCM team inside `<OpManager_Home>/conf/ncm/devicemgmt/patch`
4. In the OpManager UI, go to **Settings** → **Device Management** → **Hardware Collector** (or **Settings** → **NCM** → **Device Management** → **Hardware Collector**, depending on your product UI).
5. Click **Hardware Populator**. The patch is applied.
6. Collect hardware data again and verify that model, series, OS type, and OS version are correct.

In an enterprise setup, apply the patch on the Central server only through the Central UI. There is no need to apply it manually on individual Probe servers.

**Note:** A Hardware Collector patch only updates the commands and parsing logic NCM uses to read hardware information. It does not modify the configuration of any managed device.

### Troubleshooting Flow

|  | Stage | If it fails |
|---|---|---|
| 1 | Device is actively managed | Add the device to NCM management |
| 2 | Configuration backup completed successfully at least once | Resolve the backup failure first |
| 3 | Verify model, series, OS type, and OS version are populated and valid | Go to [Scenario B](https://www.manageengine.com/network-configuration-manager/help/firmware-vulnerability-and-eol-eos-detection.html#scenario-b) |
| 4 | If details are missing or invalid, review Hardware Collector data and identify command/parser change | Share collector data with the NCM team |
| 5 | Apply patch via Hardware Populator | See [Apply a Hardware Collector Patch](https://www.manageengine.com/network-configuration-manager/help/firmware-vulnerability-and-eol-eos-detection.html#apply-patch) |
| 6 | Collect hardware data again and verify details | Repeat from stage 4 |
| 7 | NCM uses corrected device details to retrieve EOL/EOS and vulnerability data | If data is still unavailable despite valid details, verify EOL/EOS or vulnerability mapping availability with the NCM team |

**Note:** The Hardware Data Collector and Hardware Populator address device-information collection and parsing only. Correct device details are required before NCM can identify the right EOL/EOS and vulnerability records, but the final result also depends on that data being available and mapped in NCM.

## FAQs