Distributing Product Vulnerability Information: The Cisco VEXperience
summary
Demo of Cisco’s CVR portal (prod May 2022, VEX download added Jun 2023) and an analysis of ~170k valid queries shows concrete results: 6,589 VEX downloads, 7,700 unique third‑party CVEs queried by ~13,000 users, and a huge concentration — 10 products = 70% of queries and just 17 CVEs (>1,000 hits) making up >50% of traffic. Covers mainly OpenSSH/OpenSSL; guest sign‑up is free; API is in testing. Technical takeaways, data counts, and product lists let viewers judge operational value.
AI-written summary · about
chapters (15)
- 0:00Cisco VEXperience intro
- 2:10Vulnerability distribution mechanisms
- 7:27Cisco Vulnerability Repository
- 11:00CVR access requirements
- 12:04CVR usage statistics
- 22:29Top queried vulnerabilities
- 28:17VEX document downloads
- 33:28Customer ROI justification
- 40:19Vulnerability severity assessment
- 46:06Future CVR and VEX plans
- 51:04Engaging with Cisco and vendors
- 52:31Impact on support teams
- 53:59Prioritizing third-party advisories
- 55:24Air-gapped systems access
- 57:00Q&A
related talks
45mVEXing Open Source Security: Vulnerability Data for Everything
32mUnderstanding Exploitability with VEX, EPSS, and Other Standard Frameworks
57mSeeing the Vulnerable Forest Through the Exploited Trees
29mDiving into the CVSS Base Score Metrics - An Exploratory Analysis Bridging Product Security...
45mCSAF/VEX: Improved Security Data
39mCVE 101: The Unfolding Of A Zero Day Attack
17mThe Hidden Cost of CVEs: Can CSAF and VEX Change the Equation?
52mThe Evolution of CVEs, Vulnerability Management, and Hybrid Architectures