GetDriverFirmwareVulnerabilities
(Windows only) Report the CVEs this device is still exposed to, matched from driv.dat loaded with LoadDriverFirmwareDatabase; patch_driver_firmware.dat is not needed. The list is deduplicated across components and carries no patch state: a CVE the device is already current on is not returned, so an empty list means none was found open, not that the device is fully patched. Patch state is reported by DetectDriverFirmwarePatches.
Syntax
Method ID
#define WA_VMOD_GET_DRIVER_FIRMWARE_VULNERABILITIES 50904
JSON Input Structure
{
"input": {
"method": 50904,
"inventory_file": string
}
}
Input Properties
| Parameter | Type | Description |
|---|---|---|
inventory_file | string | (optional) Path to the inventory JSON file generated by CollectDeviceInventory. If omitted, the engine collects inventory internally. |
JSON Output Structure
{
"result": {
"method": 50904,
"code": number,
"timing": number,
"timestamp": string,
"detected_vendor": string,
"machine_type": string,
"cves": [
{
"cve": string,
"severity": string,
"severity_index": number,
"description": string,
"category": string,
"fixed_patches": [
string,
...
],
"details": {
"published_epoch": number,
"epss": {
"score": string,
"percentile": string,
"date": string
},
"references": [
{
"url": string,
"name": string,
"reference_type": string,
"source": string
},
...
],
"impact_score": string,
"exploitability_score": string,
"cvss_2_0": {
"base_score": string,
"base_severity": string,
"access_vector": string,
"access_complexity": string,
"authentication": string,
"confidentiality_impact": string,
"integrity_impact": string,
"availability_impact": string,
"source": string,
"vector_string": string,
"version": string,
"last_modified": string
},
"cvss_3_0": {
"base_score": string,
"base_severity": string,
"attack_vector": string,
"attack_complexity": string,
"privileges_required": string,
"user_interaction": string,
"scope": string,
"confidentiality_impact": string,
"integrity_impact": string,
"availability_impact": string,
"source": string,
"vector_string": string,
"version": string,
"last_modified": string
},
"cvss_4_0": {
"base_score": string,
"base_severity": string,
"attack_vector": string,
"attack_complexity": string,
"attack_requirements": string,
"privileges_required": string,
"user_interaction": string,
"vulnerable_system_confidentiality": string,
"vulnerable_system_integrity": string,
"vulnerable_system_availability": string,
"subsequent_system_confidentiality": string,
"subsequent_system_integrity": string,
"subsequent_system_availability": string,
"safety": string,
"automatable": string,
"recovery": string,
"value_density": string,
"vulnerability_response_effort": string,
"provider_urgency": string,
"source": string,
"vector_string": string,
"version": string,
"last_modified": string
}
}
},
...
]
}
}
Output Properties
| Property | Type | Description |
|---|---|---|
result.method | number | The method ID that generated this result. |
result.code | number | The result code. See Result Codes. |
result.timing | number | The measured time for the method call in milliseconds. |
result.timestamp | string | The timestamp in seconds of when the call was made. |
result.detected_vendor | string | Vendor identified for CVE matching (e.g., "dell", "lenovo"). |
result.machine_type | string | Machine type read from the endpoint inventory (e.g., "21F6"). |
result.cves | array<object> | CVEs this device is still exposed to, listed once each. Empty array if none was found. |
result.cves.cve | string | CVE identifier. |
result.cves.severity | string | (optional) OPSWAT risk rating: "critical", "important", "moderate" or "low". Absent when the database carries no rating for the CVE. This is not a CVSS severity; CVSS severity is reported per rating as base_severity. |
result.cves.severity_index | number | (optional) OPSWAT risk score on a 100 point scale, with 100 being greatest; severity is its bucket. Present only together with severity. |
result.cves.description | string | CVE description, from the CVE's record. A CVE the database carries no record for is not returned. |
result.cves.category | string | Category of the endpoint component this CVE was attributed to. |
result.cves.fixed_patches | array<string> | Patch identifiers of the missing patches whose target version meets the version that fixes this CVE, as spelled by DetectDriverFirmwarePatches. Empty when no missing patch reaches it. |
result.cves.details | object | (optional) Everything the CVE record carries that the entry does not already state. |
result.cves.details.published_epoch | number | Epoch timestamp of when the CVE was published. |
result.cves.details.epss | object | (optional) EPSS exploit prediction for the CVE. |
result.cves.details.epss.score | string | EPSS probability of exploitation in the next 30 days. |
result.cves.details.epss.percentile | string | EPSS percentile among all scored CVEs. |
result.cves.details.epss.date | string | Date the EPSS score was produced, YYYY-MM-DD. |
result.cves.details.references | array<object> | (optional) Reference pages published for the CVE. |
result.cves.details.references.url | string | Reference URL. |
result.cves.details.references.name | string | Reference name as published. |
result.cves.details.references.reference_type | string | Reference type as published. Empty when the source states none. |
result.cves.details.references.source | string | Party that published the reference. |
result.cves.details.impact_score | string | (optional) Impact sub-score, passed through from the CVE record when it carries one. Not part of any CVSS object. |
result.cves.details.exploitability_score | string | (optional) Exploitability sub-score, passed through from the CVE record when it carries one. Not part of any CVSS object. |
result.cves.details.cvss_2_0 | object | (optional) CVSS 2.0 rating, with the metrics encoded in its vector string expanded into named fields. |
result.cves.details.cvss_3_0 | object | (optional) CVSS 3.0 or 3.1 rating, with the metrics encoded in its vector string expanded into named fields. Which of the two is stated by its version field. |
result.cves.details.cvss_4_0 | object | (optional) CVSS 4.0 rating, with the metrics encoded in its vector string expanded into named fields. |
result.cves.details.cvss_2_0.base_score | string | (optional) CVSS 2.0 base score. |
result.cves.details.cvss_2_0.base_severity | string | (optional) CVSS 2.0 severity: "LOW", "MEDIUM" or "HIGH". |
result.cves.details.cvss_2_0.access_vector | string | (optional) Expanded from AV: "LOCAL", "ADJACENT_NETWORK" or "NETWORK". |
result.cves.details.cvss_2_0.access_complexity | string | (optional) Expanded from AC: "HIGH", "MEDIUM" or "LOW". |
result.cves.details.cvss_2_0.authentication | string | (optional) Expanded from Au: "MULTIPLE", "SINGLE" or "NONE". |
result.cves.details.cvss_2_0.confidentiality_impact | string | (optional) Expanded from C: "NONE", "PARTIAL" or "COMPLETE". |
result.cves.details.cvss_2_0.integrity_impact | string | (optional) Expanded from I: "NONE", "PARTIAL" or "COMPLETE". |
result.cves.details.cvss_2_0.availability_impact | string | (optional) Expanded from A: "NONE", "PARTIAL" or "COMPLETE". |
result.cves.details.cvss_2_0.source | string | Provider that published this rating (e.g. "NVD"). |
result.cves.details.cvss_2_0.vector_string | string | The CVSS vector this rating was computed from. |
result.cves.details.cvss_2_0.version | string | (optional) CVSS version of this rating as published ("2.0"). |
result.cves.details.cvss_2_0.last_modified | string | (optional) Date this rating was last modified, YYYY-MM-DD. |
result.cves.details.cvss_3_0.base_score | string | CVSS 3.x base score. |
result.cves.details.cvss_3_0.base_severity | string | CVSS 3.x severity: "NONE", "LOW", "MEDIUM", "HIGH" or "CRITICAL". |
result.cves.details.cvss_3_0.attack_vector | string | (optional) Expanded from AV: "NETWORK", "ADJACENT_NETWORK", "LOCAL" or "PHYSICAL". |
result.cves.details.cvss_3_0.attack_complexity | string | (optional) Expanded from AC: "LOW" or "HIGH". |
result.cves.details.cvss_3_0.privileges_required | string | (optional) Expanded from PR: "NONE", "LOW" or "HIGH". |
result.cves.details.cvss_3_0.user_interaction | string | (optional) Expanded from UI: "NONE" or "REQUIRED". |
result.cves.details.cvss_3_0.scope | string | (optional) Expanded from S: "UNCHANGED" or "CHANGED". |
result.cves.details.cvss_3_0.confidentiality_impact | string | (optional) Expanded from C: "NONE", "LOW" or "HIGH". |
result.cves.details.cvss_3_0.integrity_impact | string | (optional) Expanded from I: "NONE", "LOW" or "HIGH". |
result.cves.details.cvss_3_0.availability_impact | string | (optional) Expanded from A: "NONE", "LOW" or "HIGH". |
result.cves.details.cvss_3_0.source | string | Provider that published this rating (e.g. "NVD"). |
result.cves.details.cvss_3_0.vector_string | string | The CVSS vector this rating was computed from. |
result.cves.details.cvss_3_0.version | string | (optional) CVSS version of this rating as published: "3.0" or "3.1". |
result.cves.details.cvss_3_0.last_modified | string | (optional) Date this rating was last modified, YYYY-MM-DD. |
result.cves.details.cvss_4_0.base_score | string | CVSS 4.0 base score. |
result.cves.details.cvss_4_0.base_severity | string | CVSS 4.0 severity: "NONE", "LOW", "MEDIUM", "HIGH" or "CRITICAL". |
result.cves.details.cvss_4_0.attack_vector | string | (optional) Expanded from AV: "NETWORK", "ADJACENT_NETWORK", "LOCAL" or "PHYSICAL". |
result.cves.details.cvss_4_0.attack_complexity | string | (optional) Expanded from AC: "LOW" or "HIGH". |
result.cves.details.cvss_4_0.attack_requirements | string | (optional) Expanded from AT: "NONE" or "PRESENT". |
result.cves.details.cvss_4_0.privileges_required | string | (optional) Expanded from PR: "NONE", "LOW" or "HIGH". |
result.cves.details.cvss_4_0.user_interaction | string | (optional) Expanded from UI: "NONE", "PASSIVE" or "ACTIVE". |
result.cves.details.cvss_4_0.vulnerable_system_confidentiality | string | (optional) Expanded from VC: "NONE", "LOW" or "HIGH". |
result.cves.details.cvss_4_0.vulnerable_system_integrity | string | (optional) Expanded from VI: "NONE", "LOW" or "HIGH". |
result.cves.details.cvss_4_0.vulnerable_system_availability | string | (optional) Expanded from VA: "NONE", "LOW" or "HIGH". |
result.cves.details.cvss_4_0.subsequent_system_confidentiality | string | (optional) Expanded from SC: "NONE", "LOW" or "HIGH". |
result.cves.details.cvss_4_0.subsequent_system_integrity | string | (optional) Expanded from SI: "NONE", "LOW" or "HIGH". |
result.cves.details.cvss_4_0.subsequent_system_availability | string | (optional) Expanded from SA: "NONE", "LOW" or "HIGH". |
result.cves.details.cvss_4_0.safety | string | (optional) Expanded from S, a Supplemental metric: "NEGLIGIBLE" or "PRESENT". Empty when the vector leaves it undefined. |
result.cves.details.cvss_4_0.automatable | string | (optional) Expanded from AU, a Supplemental metric: "NO" or "YES". Empty when the vector leaves it undefined. |
result.cves.details.cvss_4_0.recovery | string | (optional) Expanded from R, a Supplemental metric: "AUTOMATIC", "USER" or "IRRECOVERABLE". Empty when the vector leaves it undefined. |
result.cves.details.cvss_4_0.value_density | string | (optional) Expanded from V, a Supplemental metric: "DIFFUSE" or "CONCENTRATED". Empty when the vector leaves it undefined. |
result.cves.details.cvss_4_0.vulnerability_response_effort | string | (optional) Expanded from RE, a Supplemental metric: "LOW", "MODERATE" or "HIGH". Empty when the vector leaves it undefined. |
result.cves.details.cvss_4_0.provider_urgency | string | (optional) Expanded from U, a Supplemental metric: "CLEAR", "GREEN", "AMBER" or "RED". Empty when the vector leaves it undefined. |
result.cves.details.cvss_4_0.source | string | Provider that published this rating (e.g. "NVD"). |
result.cves.details.cvss_4_0.vector_string | string | The CVSS vector this rating was computed from. |
result.cves.details.cvss_4_0.version | string | (optional) CVSS version of this rating as published ("4.0"). |
result.cves.details.cvss_4_0.last_modified | string | (optional) Date this rating was last modified, YYYY-MM-DD. |
Result Codes
| Code | Name | Description |
|---|---|---|
| 0 | WAAPI_OK | The operation completed successfully. |
note
Other codes may be returned. See the full Result Codes reference for the complete list.
Remarks
Error Handling
The results of this function are determined by the error code returned by the call. If successful, WAAPI_OK or a special success code will be returned. Always check both the function return value and the result.code field in the output JSON.
Examples
Examples will be added here demonstrating the usage of this method.
See Also
Last updated: 2026-11-04