TELUS Digital · Security Tooling

Cisco Advisory Impact Analyzer

Check a Cisco advisory bundle against your firewall inventory.

Cisco publishes firewall vulnerabilities in bundles — an Event Response page listing every advisory released that day. Paste the link to one and this tool checks every advisory in it against your inventory, device by device, on each firewall's exact hardware model and software release. You get a self-contained HTML report naming which of your devices and releases that publication impacts, and the release that fixes each. Every verdict comes from Cisco; nothing is inferred, and a firewall it could not check is never reported as safe.

Install with uv one command View on GitHub

Runs on macOS, Windows & Linux · installed as a uv tool · your data never leaves your machine

One bundle, every firewall

Paste the Event Response link and every firewall in your inventory is checked against every advisory in that publication — not just the devices someone thought to look at.

Cisco's own answer

Verdicts come from Cisco's PSIRT advisory API — the data behind Cisco's public Software Checker — so findings are reproducible and defensible.

Never guesses at safety

A device Cisco can't confirm is Needs review with the reason — never reported as safe. The report says what to fix in your inventory.

01Before you start

uv — Astral's Python tool installer; it manages Python for you. Not sure if you have it? Check & install it below.
Git — uv uses it to fetch the tool from GitHub. Not sure if you have it? Check & install it below.
Cisco PSIRT API credentials — a client ID and secret from developer.cisco.com/psirt, one per person (see “Get your credentials” below).
Your firewall inventory — an Excel .xlsx (sheet FW_List) in the folder you run from.
Internet access — to apix.cisco.com, id.cisco.com and sec.cloudapps.cisco.com.

Get uv & Git — both are needed before you install the tool. First check whether each is already installed, and install only what's missing. Pick your operating system:

uv 1Check if uv is already installed In the Terminal app. Prints a version number if it's there; says “command not found” if it isn't.

uv --version

2Not installed? Install it Official standalone installer — no admin rights needed.

curl -LsSf https://astral.sh/uv/install.sh | sh

Prefer Homebrew? brew install uv. Afterwards, open a new terminal and re-run uv --version to confirm.

Git 1Check if Git is already installed In the Terminal app. Prints a version number if it's there; if it isn't, macOS itself offers to install the Xcode Command Line Tools (which include Git) — accept that prompt.

git --version

Prefer Homebrew? brew install git. Afterwards, open a new terminal and re-run git --version to confirm.

uv 1Check if uv is already installed In PowerShell. Prints a version number if it's there; errors if it isn't.

uv --version

2Not installed? Install it Official standalone installer, run in PowerShell.

powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"

Prefer a package manager? winget install --id=astral-sh.uv -e or scoop install main/uv. Afterwards, open a new terminal and re-run uv --version to confirm.

Git 1Check if Git is already installed In PowerShell. Prints a version number if it's there; errors if it isn't.

git --version

2Not installed? Install it Official installer.

winget install --id Git.Git -e --source winget

Prefer a manual download? Get it from git-scm.com. Afterwards, open a new terminal and re-run git --version to confirm.

uv 1Check if uv is already installed In your terminal. Prints a version number if it's there; says “command not found” if it isn't.

uv --version

2Not installed? Install it Official standalone installer — no root needed.

curl -LsSf https://astral.sh/uv/install.sh | sh

Prefer pip/pipx? pipx install uv (or pip install uv). Afterwards, open a new terminal and re-run uv --version to confirm.

Git 1Check if Git is already installed In your terminal. Prints a version number if it's there; says “command not found” if it isn't.

git --version

2Not installed? Install it with your package manager Debian/Ubuntu shown below; use your distro's package manager otherwise (e.g. dnf install git, pacman -S git).

sudo apt-get update && sudo apt-get install -y git

More install methods & details: uv installation docs · Git downloads.

02Install & run

Install the tool with uv (one command, works the same on every OS):
```
uv tool install caia-cli --from git+https://github.com/xavient/caia-cli
```
This puts a single caia command on your PATH — no cloning, no virtual environment to activate.
Configure your credentials (stored once, per user; used from any folder):
```
caia --config
```
One pass, and every prompt is skippable. The client secret is never displayed; after you paste it the tool confirms how many characters it captured, then checks the credentials against Cisco before saving.
Run it from the folder holding your inventory:
```
cd /path/to/your/inventory-folder
```
```
caia
```
The report impact_report_<date>.html appears in an output folder. Every firewall gets one status — Impacted (with each advisory's severity, CVEs, a link to Cisco and the release that fixes it), Not impacted, or Needs review. A device that could not be checked is never reported as safe; the report says why instead.
Or check one advisory bundle — Cisco publishes firewall vulnerabilities in bundled publications. Paste the Event Response link at the prompt, or skip the prompt:
```
caia --erp ERP-75736
```
The report flips to one row per advisory in that bundle: the advisory with its publication date, what Cisco says the advisory affects — Cisco's own Vulnerable Products and Products Confirmed Not Vulnerable statements, reproduced in Cisco's words — and which of your devices it impacts with the release that fixes them. Advisories that hit nothing still get a row. Firewalls that could not be checked appear in every row they might belong to, marked undetermined — never counted as unaffected. Where Cisco's scope statement could not be retrieved the report says so and why; that is never shown as "nothing affected". The report states how many advisories the bundle filter left out, so it can't be mistaken for a whole-fleet assessment.
Stay up to date — check your version and update via uv:
```
caia --version
```
```
caia --update
```
A normal run also offers to update first when a newer version is available.
Uninstall — remove the tool the same way it was installed (add --yes to skip the prompt, e.g. for scripts):
```
caia --uninstall
```
Your saved settings are kept — the per-user config file is never touched, and the tool prints its location so you can delete it yourself. If you installed without uv, it reports there's nothing to uninstall.

Upgrading from the old name? Before version 3.0.0 the tool installed as cisco-advisory-impact-agent. Both own the caia command, so remove the old one with uv tool uninstall cisco-advisory-impact-agent before running the install above — caia --update cannot make this jump for you. Your saved credentials are untouched, so you don't need to re-run --config.

Coming from version 3.x? The advisory-driven mode — caia --url, which used AI to read one advisory and produced an Excel file — was removed in 4.0.0, along with --api, --dry-run, --keep-temp and --no-keep-temp. What --api used to do is now what plain caia does, and you no longer need a FueliX API key. Pass a removed option and the tool tells you so, and what to run instead.

No uv? You can install with just Python 3.9+ (a venv + pip install . from the source) — see Install without uv in the README. The full walkthrough, output guide, and troubleshooting also live in the README.

03Get your Cisco credentials

Go to developer.cisco.com/psirt and sign in with your Cisco account.
Register an application to get a client ID and client secret for the openVuln API.
Copy both values.
Paste them when you run caia --config.

Each person uses their own credentials — don’t share them. They’re stored locally in a per-user config file (owner-only) and are never shared or committed.