cisco-psirt-advisories

Cisco PSIRT Advisory Checks

Answers one question well: is the software this device is running affected by a Cisco security advisory?

Read this first — an empty result is not a clean bill of health

Every tool returns one of five outcome values. Two of them look similar in the data and mean completely different things:

outcome	What it means
advisories_found	Cisco has published advisories for this version
none_published	Cisco has published nothing for this version — NOT "the device is secure"
normalisation_failed	The version could not be parsed. Nothing was checked.
unsupported_ostype	Not a PSIRT OS family (includes iosxr and every non-Cisco platform)
api_error	Auth failure, rate limit, or a version Cisco has no record of

Never report "no advisories" as "not vulnerable". none_published means Cisco has published nothing matching that exact version string. It says nothing about unpatched-but-unpublished issues, configuration weaknesses, or anything outside Cisco's PSIRT process.

Never treat normalisation_failed or api_error as good news. Both mean the question went unasked. In a fleet sweep, check the outcome_summary counts before telling anyone the fleet is clean — devices in those two buckets were never checked at all.

The two-step chain

This server never contacts a device. It has no transport, no credentials for your network, and no way to read a version. You supply the version:

Step 1 — read the version off the device.

# Cisco platforms: pyATS
python3 $MCP_CALL "python3 -u $PYATS_MCP_SCRIPT" run_show_command \
  '{"device_name":"cat9k-1","command":"show version"}'

# Anything else, or when pyATS has no parser: the multivendor CLI driver
python3 $MCP_CALL "python3 -u $MULTIVENDOR_MCP_SCRIPT" device_run_command \
  '{"device":"rtr-1","command":"show version"}'

Step 2 — pass it here. Full show version output is fine; the banner is parsed.