# Create virtual environment
python -m venv venv
source venv/bin/activate  # On Windows: venv\Scripts\activate

# Install necessary libraries
# Netmiko: For SSH connections to IOS XE
# Requests: For API calls to NVD/Cisco APIs
# Pydantic: For data validation
pip install netmiko requests pydantic python-dotenv

# Initialize project
npm init -y

# Install dependencies
# Netmiko equivalent: ssh2
# Axios: For API requests
# Dotenv: For environment variables
npm install ssh2 axios dotenv
npm install --save-dev typescript @types/node

import os
import requests
from netmiko import ConnectHandler
from dotenv import load_dotenv
from typing import Dict, List

# Load environment variables
load_dotenv()

class CiscoSecurityAuditor:
    def __init__(self, device_config: Dict[str, str]):
        self.device_config = device_config
        self.version = ""

    def get_device_version(self) -> str:
        """Connects via SSH and parses the IOS XE version."""
        try:
            print(f"[*] Connecting to {self.device_config['host']}...")
            with ConnectHandler(**self.device_config) as net_connect:
                # Command to get version info
                output = net_connect.send_command("show version")
                
                # Simple parsing logic for 'Version X.X'
                for line in output.splitlines():
                    if "Version" in line:
                        # Extracting the version string (e.g., 17.3.1)
                        self.version = line.split("Version")[1].split(",")[0].strip()
                        return self.version
            return "Unknown"
        except Exception as e:
            return f"Connection Error: {str(e)}"

    def check_vulnerabilities(self, version: str) -> List[Dict]:
        """
        Simulates checking the version against a CVE database.
        In production, replace this with a call to NIST NVD API.
        """
        # Mock Vulnerability Database
        VULN_DB = {
            "17.3.1": [{"cve": "CVE-2023-XXXX", "severity": "Critical", "desc": "SD-WAN Buffer Overflow"}],
            "17.6.1": [{"cve": "CVE-2024-YYYY", "severity": "High", "desc": "IOS XE Web UI Vulnerability"}]
        }
        
        return VULN_DB.get(version, [])

    def run_audit(self):
        version = self.get_device_version()
        print(f"[+] Detected Version: {version}")
        
        if version == "Unknown":
            print("[!] Could not retrieve version.")
            return

        vulnerabilities = self.check_vulnerabilities(version)
        
        if vulnerabilities:
            print(f"[!!!] VULNERABILITIES FOUND in {version}:")
            for v in vulnerabilities:
                print(f"    - {v['cve']} [{v['severity']}]: {v['desc']}")
        else:
            print("[✓] No known vulnerabilities found for this version in local DB.")

if __name__ == "__main__":
    # Configuration (Should be loaded from secure env)
    target_device = {
        'device_type': 'cisco_ios',
        'host': os.getenv('DEVICE_IP', '192.168.1.1'),
        'username': os.getenv('NET_USER', 'admin'),
        'password': os.getenv('NET_PASS', 'cisco123'),
        'ecret': os.getenv('NET_SECRET', 'cisco123'), # For enable mode
    }

    auditor = CiscoSecurityAuditor(target_device)
    auditor.run_audit()

import { Client } from 'sh2';
import axios from 'axios';
import * as dotenv from 'dotenv';

dotenv.config();

interface Vulnerability {
    cve: string;
    severity: string;
    description: string;
}

class CiscoAuditor {
    private host: string;
    private username: string;
    private password: string;

    constructor(host: string, user: string, pass: string) {
        this.host = host;
        this.username = user;
        this.password = pass;
    }

    /**
     * Connects via SSH and retrieves version
     */
    async getVersion(): Promise<string> {
        return new Promise((resolve, reject) => {
            const conn = new Client();
            conn.on('ready', () => {
                conn.exec('show version', (err, stream) => {
                    if (err) reject(err);
                    let data = '';
                    stream.on('data', (chunk) => { data += chunk; });
                    stream.on('close', () => {
                        conn.end();
                        // Simple regex to find version pattern
                        const match = data.match(/Version\s+([\d\.]+)/);
                        resolve(match? match[1] : 'Unknown');
                    });
                });
            }).on('error', reject).connect({
                host: this.host,
                port: 22,
                username: this.username,
                password: this.password
            });
        });
    }

    /**
     * Checks version against a simulated vulnerability list
     */
    async checkCVEs(version: string): Promise<Vulnerability[]> {
        // In production, use: await axios.get(`https://services.nvd.nist.gov/rest/json/cves/2.0?keyword=${version}`)
        const mockDB: Record<string, Vulnerability[]> = {
            "17.3.1": [{ cve: "CVE-2023-XXXX", severity: "Critical", description: "SD-WAN Buffer Overflow" }]
        };
        return mockDB[version] || [];
    }

    async run() {
        try {
            console.log(`[*] Auditing ${this.host}...`);
            const version = await this.getVersion();
            console.log(`[+] Version: ${version}`);

            const vulns = await this.checkCVEs(version);
            if (vulns.length > 0) {
                console.warn(`[!!!] Found ${vulns.length} vulnerabilities!`);
                console.table(vulns);
            } else {
                console.log('[✓] Device is compliant.');
            }
        } catch (error) {
            console.error('[X] Audit failed:', error);
        }
    }
}

// Execution
const auditor = new CiscoAuditor(
    process.env.DEVICE_IP || '192.168.1.1',
    process.env.NET_USER || 'admin',
    process.env.NET_PASS || 'cisco123'
);
auditor.run();

# Network Device Credentials
DEVICE_IP=10.0.0.5
NET_USER=admin
NET_PASS=YourSecurePassword
NET_SECRET=YourEnableSecret

# API Keys (If using NVD or Cisco APIs)
NVD_API_KEY=your_api_key_here