Edge Exposure Auditor

Cross-references your internet-facing / edge devices against the CISA Known Exploited Vulnerabilities (KEV) catalog — the authoritative list of CVEs being exploited in the wild — and reports what's affected, prioritized by ransomware use and overdue patch deadlines.

Why

Exploited edge devices — firewalls, VPN gateways, routers — are the leading initial-access vector in breaches today. The highest-signal input to patch prioritization isn't "what's vulnerable," it's "what's being actively exploited." This tool turns the KEV catalog into an exposure report for your own inventory.

Features

• Pulls the live CISA KEV catalog (free, no auth)
• Matches your device inventory against known-exploited CVEs
• Prioritizes by ransomware-campaign use and overdue remediation dates
• Optional discovery: build a draft inventory from a device CSV (MAC -> vendor)
• --only-ransomware filter and --json output for automation
• Non-zero exit code when exposures are found — drop it into a cron job or CI pipeline

Example

[!] ASUS Router (vGT-AXE11000)  —  2 known-exploited CVE(s)
    CVE-2021-32030  added 2025-06-02  due 2025-06-23  [OVERDUE]
      ASUS Routers Improper Authentication Vulnerability
      https://nvd.nist.gov/vuln/detail/CVE-2021-32030
SUMMARY: 2 finding(s) | 0 ransomware-linked | 2 past due

A match means the product family has actively-exploited CVEs — you still confirm the exact model and version against the linked CVE (the analyst step).

How it works

Reads a JSON inventory of your devices and the KEV catalog, matches on vendor/product, and reports. No scanning, no credentials — it's a catalog lookup against a list you control.

Discovery (optional)

discover.py turns a device list (e.g. a router's client-list CSV export) into a draft inventory by resolving each device's vendor from its MAC address, offline:

python discover.py devices.csv          # writes home-inventory.json
python kev_exposure.py --inventory home-inventory.json

Auto-discovery is a starting draft — vendor-only matching is noisy for big vendors, so curate down to internet-facing devices and fill in product/version before trusting the result.

Usage

python kev_exposure.py                      # live KEV + inventory.json
python kev_exposure.py --only-ransomware    # ransomware-linked only
python kev_exposure.py --json               # machine-readable
python kev_exposure.py --kev-file kev.json  # offline, from a cached catalog

Inventory format

[{ "vendor": "Palo Alto Networks", "product": "PAN-OS", "version": "10.2.0" }]

Files

File	Purpose
kev_exposure.py	Cross-references an inventory against the live KEV catalog
discover.py	Builds a draft inventory from a device CSV via MAC OUI lookup
inventory.json	Sample inventory
requirements.txt	Python dependency for discovery (netaddr)
.gitignore	Keeps your real network data out of the repo

Setup

pip install -r requirements.txt

Roadmap

• Version-precise matching via NVD CPE ranges (filter out CVEs that don't hit your exact model)
• Web app: upload a device CSV, get the report in the browser
• Continuous monitoring with alerting when a new KEV entry hits your inventory

Responsible use

This tool performs no scanning. It reads a public catalog and an inventory you provide. Any future active-discovery features are strictly for systems you own or are explicitly authorized to test.