{"uid":"cap_gVYTCyoFeqebmuTC1A_2t","slug":"ot-intel-api-onrender-com-31db0df9","name":"OT-Intel CVE Triage API","description":"OT-contextualised CVE triage for ICS/SCADA. Pass ?id=CVE-XXXX-XXXX. Returns OT-adjusted severity, cyber-physical impact, patch feasibility, CISA KEV status, and prioritised action. DeepSeek-enriched with live NVD and CISA-KEV data.","url":"https://ot-intel-api.onrender.com/ot/cve","method":"GET","headers":{},"bodySchema":{"type":"object","$schema":"https://json-schema.org/draft/2020-12/schema","required":["input"],"properties":{"input":{"type":"object","required":["type","method"],"properties":{"type":{"type":"string","const":"http"},"method":{"enum":["GET"],"type":"string"},"queryParams":{"type":"object","required":["id"],"properties":{"id":{"type":"string","description":"CVE identifier e.g. CVE-2023-38802"}}}},"additionalProperties":false},"output":{"type":"object","required":["type"],"properties":{"type":{"type":"string"},"example":{"type":"object"}}}}},"responseSchema":{"type":"json","example":{"cve_id":"CVE-2019-13945","summary":"A vulnerability has been identified in SIMATIC S7-1200 CPU family (All versions). The web server of the affected devices transmits data without TLS encryption.","freshness":"2025-05-22T10:00:00.000Z","cvss_score":6.8,"ot_context":{"affected_layer":"field_device","patch_feasibility":"low — requires maintenance window","safety_system_risk":true,"production_downtime":true,"ot_adjusted_severity":"high"},"data_sources":["NVD","CISA-KEV","DeepSeek-CTI-Analysis"],"kev_due_date":null,"actively_exploited":false,"recommended_action":"HIGH: Schedule patch for next maintenance window.","compensating_controls":["Isolate PLC from IT network via VLAN","Disable web server interface if unused","Deploy unidirectional gateway for historian traffic"]}},"example":{"request":{"input":{"type":"http","method":"GET","queryParams":{"id":"CVE-2023-38802"}}},"response":{"scope":{"blast_radius":"widespread","affected_component":"FRRouting FRR (7.5.1-9.0) and Pica8 PICOS 4.3.3.2 BGP implementation"},"cve_id":"CVE-2023-38802","summary":"FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial of service via a crafted BGP update with a corrupted attribute 23 (Tunnel Encapsulation).","urgency":{"level":"high","public_poc_exists":true,"active_exploitation":false,"weaponization_complexity":"trivial"},"exposure":{"credentials_required":false,"trivially_exploitable":true,"network_position_required":"Any network reachable to the BGP speaker (TCP port 179). No authentication required."},"freshness":"2026-06-18T05:15:11.451Z","mechanism":{"type":"implementation_bug","detail":"A crafted BGP update with a corrupted attribute 23 (Tunnel Encapsulation) causes a denial of service due to improper handling of malformed attributes (CWE-354). This is a software implementation bug in the BGP stack."},"cvss_score":7.5,"ot_context":{"affected_layer":"unknown","patch_feasibility":"unknown","safety_system_risk":false,"production_downtime":true,"ot_adjusted_severity":"high"},"data_sources":["NVD","CISA-KEV","DeepSeek-CTI-Analysis"],"kev_due_date":null,"analyst_notes":"Public PoC and detailed technical description available (benjojo blog). The vulnerability is trivial to exploit with a single crafted BGP packet. While not yet in CISA KEV, the ease of exploitation and widespread use of FRR in Linux-based routers and Pica8 switches make this a high priority for OT environments. Patching should be scheduled at the next maintenance window; in the interim, strict BGP peer filtering and monitoring are essential.","actively_exploited":false,"recommended_action":"HIGH: Schedule patch for next maintenance window.","cyber_physical_impact":{"category":"dos","plain_english":"A remote attacker can crash the BGP process on routers or switches running affected software, causing loss of BGP peering and disrupting network routing. In OT/ICS environments, this can lead to loss of connectivity between control centers and remote sites, potentially blinding operators to process status or preventing remote commands from reaching field devices."},"operational_mitigation":{"patch_feasibility":"scheduled_maintenance","compensating_controls":["Restrict BGP peering to trusted IPs only via ACLs on network devices and firewalls.","Deploy BGP TTL Security Hop Count (GTSM) to limit BGP packets to directly connected peers.","Monitor BGP session state and configure alerts for unexpected peer resets.","If possible, use BGP prefix limits and route flap damping to reduce impact.","Segment OT network to limit BGP exposure to only necessary connections."]}}},"exampleRequest":{"id":"CVE-2023-38802"},"tags":["x402"],"displayCostAmount":"0.02","displayCostAsset":"USDC","priceDynamic":false,"priceHint":null,"priceStatus":"priced","priceSource":"settled","requiresHandshake":false,"reviewCount":0,"rating":{"score":"0.00","successRate":"0.00","reviews":0,"stars":null,"state":"unrated"},"availabilityStatus":"unknown","priceObserved":null,"sessionDeposit":null,"pricing":{"kind":"static","summary":"$0.02/call","primary":{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"},"accepted":[{"kind":"static","protocol":"x402","network":"base","amountUsd":"0.02","per":"call","confidence":"exact"}]},"paymentMethods":[{"uid":"pm_zKrDhZT5tpaErFygNRHhl","protocol":"x402","methodType":"crypto","chain":"base","mode":"charge","costAmount":"0.02","costPer":"request","priority":0,"asset":"0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913","unit":"request","depositMicros":null,"planRef":null}],"brandName":null,"brandSlug":null,"brandBaseUrl":null,"brandDocsUrl":null,"whatItDoes":"Returns OT-adjusted CVE severity, cyber-physical impact, patch feasibility, and CISA KEV status for a given CVE ID in ICS/SCADA environments","exampleAgentPrompt":"What's the OT-adjusted risk for CVE-2021-34527 in an ICS environment — can it be patched without downtime and is it in the CISA KEV list?","exampleUseCases":null,"resultDescription":"Returns a JSON object with: OT-recalculated CVSS severity score (adjusted from NVD baseline for the affected ICS layer), cyber-physical impact category (e.g. loss of control, safety system impact), patch feasibility assessment (whether patching is possible without operational downtime), CISA KEV status (whether the CVE is a known exploited vulnerability), and a prioritized recommended action specific to OT/ICS operators.","failureModes":["Invalid or malformed CVE ID format returns an error","CVE ID not found in NVD returns empty or not-found response","DeepSeek LLM enrichment timeout may cause degraded or partial response","Render.com cold start may cause initial latency spike on first call","CISA KEV or NVD upstream unavailability may delay or fail the response"],"whenToPreferThis":"Use this endpoint when you need CVE intelligence specifically contextualized for OT/ICS/SCADA environments — not generic IT vulnerability data. Unlike standard NVD lookups, this recalculates severity for the industrial control system layer, assesses cyber-physical impact, evaluates patch feasibility in operational settings where downtime is costly, and cross-references CISA KEV. Prefer this over generic CVE APIs when your user operates in energy, utilities, manufacturing, water treatment, or other industrial sectors.","instructions":null,"reviewSummary":null,"reviewSummaryHighlights":null,"reviewSummaryConcerns":null,"reviewSummaryGeneratedAt":null,"activationCount":0,"lastUsedAt":null,"lastSuccessfullyRanAt":null,"lastHealthCheckAt":"2026-09-15T00:35:38.326Z","isFirstParty":false}