Common Platform Enumeration (CPE) Explained

When running a network scan on your perimeter server using Acunetix Vulnerability Scanner, one of the Informational alerts shown in the scan results is the CPE Inventory. The data that is collected during the scan is aggregated using the CPE standard, originally defined by MITRE, and is maintained by the U.S. National Institute of Standards and Technology (NIST) as part of the Security Content Automation Protocol (SCAP).

CPE is considered to be an industry standard that is used to provide a uniform way to show information on Operating Systems, hardware, and software. It can be used for software and hardware inventory, and better vulnerability management when using the results from one product to be tracked in a different product.

CPE entries in the CPE Inventory use the following format:

cpe:/ <part>:<vendor>:<product>:<version>:<update>:<edition>:<language>

Let’s look at each field in more detail:

• part: Defines the type of system detected, and can have one of the following values:
  • a – for Application
  • h – for Hardware
  • o – for Operating System
• vendor: Contains the name of the organization that developed the product.
• product: Contains the name of the product that has been detected.
• version: Lists the version number for the product.
• update: Lists the update for the product and version detected (e.g. R2 for Windows 2012, or beta for a beta version of the product).
• edition: Shows the edition of the software (e.g. server or pro or x86).
• language: Shows the language detected (e.g. English).

When Acunetix reports on the CPE Inventory, it will omit the fields that have not been identified. So, the CPE Inventory will often only include the first 3 fields. The IP address of the scanned server is also included before each CPU entry. Here is an example of how CPE information looks in Acunetix, showing that the application OpenSSH version 5.3p1 has been detected on OpenBSD, which is running on 176.28.50.165:

176.28.50.165|cpe:/a:openbsd:openssh:5.3p1

THE AUTHOR

Nicholas Sciberras
Principal Program Manager
LinkedIn

As the Principal Program Manager, Nicholas is passionate about IT security and technology at large. Prior to joining Acunetix in 2012, Nicholas spent 12 years at GFI Software, where he managed the email security and anti-spam product lines, led multiple customer service teams, and provided technical training.