CRA Compliance Report

Checks Performed:

• CISA KEV vulnerabilities present
• Configuration checks failed
• Cracked credentials detected
• Private keys compromised

Score Calculation: Starting from 100 points:

Status Thresholds: ≥80 = Compliant, 25-79 = Partial, <25 = Non-Compliant

Checks Performed:

• Presence of vulnerabilities on CISA Known Exploited Vulnerabilities (KEV) catalog
• Presence of vulnerabilities with weaponized exploits in the wild

Score Calculation:

Compliance Logic: Any CISA KEV vulnerability results in immediate non-compliance. Weaponized exploits without KEV entries result in partial compliance (30 pts).

Checks Performed:

• Cracked/weak credentials detected (passwords that can be easily broken)
• Critical security configuration checks that failed
• Exposed private keys in firmware/software

Score Calculation: Starting from 100 points:

Status Thresholds: ≥80 = Compliant, 25-79 = Partial, <25 = Non-Compliant

Checks Performed:

• Vulnerability tracking and identification capability
• Continuous monitoring for new vulnerabilities

Assessment Notes:

NetRise provides vulnerability identification and continuous monitoring capabilities. However, verification of actual update delivery mechanisms requires operational testing outside the scope of static firmware analysis.

Status: Partial - NetRise confirms monitoring capability, but update mechanism verification requires runtime testing.

Checks Performed:

• Cracked/weak credentials that could enable unauthorized access
• Exposed private keys that could compromise authentication
• High volume of critical vulnerabilities indicating access control weaknesses

Score Calculation: Starting from 100 points:

Status Thresholds: ≥80 = Compliant, 25-79 = Partial, <25 = Non-Compliant

Checks Performed:

• Certificate validity and configuration issues
• Exposed private keys that could compromise encrypted data

Score Calculation: Starting from 100 points:

Status Thresholds: ≥80 = Compliant, 25-79 = Partial, <25 = Non-Compliant

Checks Performed:

• Scan for 13 data integrity-related CWEs across 4 vulnerability families
• Information Disclosure: CWE-200, CWE-312, CWE-319
• Access Control Failures: CWE-284, CWE-285, CWE-862, CWE-863, CWE-22
• Weak/Missing Crypto: CWE-311, CWE-327
• Credential Exposure: CWE-798, CWE-522

Score Calculation:

Status Thresholds: ≥80 = Compliant, 25-79 = Partial, <25 = Non-Compliant

Assessment Status: Not Assessed

Data minimization requirements relate to limiting data collection and processing to what is necessary for the product's intended purpose. This is primarily a design and policy consideration that cannot be fully assessed through static firmware analysis.

Indirect Coverage: NetRise can identify potential data leakage risks through vulnerability analysis, but direct assessment of data minimization practices requires design documentation review.

Checks Performed:

• Scan for 12 DoS-related CWEs across 4 vulnerability families
• Resource Exhaustion: CWE-400, CWE-770, CWE-404, CWE-789, CWE-1325
• Algorithmic Complexity (CPU): CWE-1333, CWE-834, CWE-606
• Hang/Freeze: CWE-835, CWE-674, CWE-1322
• Crash-on-demand: CWE-617

Score Calculation:

Status Thresholds: ≥80 = Compliant, 25-79 = Partial, <25 = Non-Compliant

Checks Performed:

• DoS-related vulnerabilities that could impact network availability
• Critical/High severity vulnerabilities with network impact potential
• Failed security configuration checks

Assessment Notes:

This clause is assessed in conjunction with Clause 2(h) Availability Protection, as DoS vulnerabilities directly impact network service availability.

Score: 30 pts (based on DoS vulnerability assessment)

Status Thresholds: ≥80 = Compliant, 25-79 = Partial, <25 = Non-Compliant

Checks Performed:

• CISA KEV vulnerabilities (actively exploited attack vectors)
• Weaponized exploits (high-risk attack surface exposure)
• Component count (software attack surface size - threshold: 500)

Score Calculation: Starting from 100 points:

Status Thresholds: ≥80 = Compliant, 25-79 = Partial, <25 = Non-Compliant

Checks Performed:

• Weak/cracked credentials that facilitate exploitation
• Exposed private keys that could be leveraged in attacks
• Failed security configuration checks that reduce exploit barriers

Score Calculation: Starting from 100 points:

Status Thresholds: ≥80 = Compliant, 25-79 = Partial, <25 = Non-Compliant

Assessment Status: Not Assessed

Security logging and monitoring requirements relate to runtime behavior and operational configuration. Static firmware analysis has limited visibility into logging implementations.

Potential Coverage: Custom configuration checks can be developed to identify presence of logging frameworks, syslog configurations, or audit trails in the firmware image.

Assessment Status: Not Assessed

Secure data removal is primarily a functional capability that requires runtime testing to verify. Static analysis cannot confirm data removal procedures are implemented correctly.

Potential Coverage: Custom configuration checks can identify presence of factory reset mechanisms or data wipe utilities in the firmware.

Checks Performed:

• SBOM generation capability (component enumeration)
• Component-to-vulnerability correlation
• Export format support (CycloneDX, SPDX)

Assessment Logic:

Compliant if components are identified (907 found). The SBOM provides complete visibility into 907 software components, with 65 having known vulnerabilities and 842 (92.8%) being clean.

Checks Performed:

• Vulnerability discovery and tracking
• Fix version availability identification
• Continuous monitoring for new vulnerabilities

Assessment Logic:

NetRise provides automated vulnerability discovery, prioritization, and remediation guidance. 4145 vulnerabilities tracked, with 94 having known fixes available.

Checks Performed:

• CI/CD pipeline integration capability
• Continuous security monitoring
• Automated firmware/software analysis

Assessment Logic:

NetRise supports integration into development pipelines for regular security testing. Continuous monitoring ensures new vulnerabilities are identified as they are disclosed.

Checks Performed:

• VEX (Vulnerability Exploitability Exchange) document generation
• Standardized vulnerability disclosure format
• Impact and severity information availability

Assessment Logic:

NetRise supports VEX document generation for standardized vulnerability disclosure. All 4145 identified vulnerabilities include severity ratings, descriptions, and remediation guidance.

Checks Performed:

• VEX document support for coordinated disclosure
• Vulnerability impact assessment capability
• Standardized severity classification (CVSS)

Assessment Logic:

NetRise supports coordinated vulnerability disclosure through VEX document generation, enabling standardized communication with stakeholders about vulnerability status and impact.

Checks Performed:

• Third-party component vulnerability tracking
• Exportable vulnerability reports
• Multiple format support for information sharing

Assessment Logic:

NetRise identifies and tracks 4145 vulnerabilities in third-party components. Reports can be exported in VEX, CycloneDX, and SPDX formats for stakeholder sharing.

Checks Performed:

• Software version tracking across assets
• Patch validation through re-analysis
• Fix version availability detection

Assessment Logic:

NetRise provides version tracking and can validate patches through re-analysis. 94 vulnerabilities have known fix versions identified. Status is Partial as actual update distribution mechanisms require operational verification.

Checks Performed:

• VEX-formatted security advisory generation
• Remediation guidance availability
• Vulnerability prioritization data (EPSS, KEV, CVSS)

Assessment Logic:

NetRise supports VEX document generation for security advisory dissemination. Advisories include severity, impact, fix availability, and prioritization data to help users take appropriate action.