Find the CVEs that affect specific devices at their exact firmware or software version. Use this for any specific device and firmware. Send vendor, product and version exactly as the inventory says; no CPE is needed. Returns, per device: how it resolved, data coverage, an honest assessment, warnings, needs_review, result_hash (keep it for check_changes), the fix plan, and the top findings in priority order (known-exploited and confirmed first). Each finding gives the affected range with its source, the fix, advisory guidance and vendor advisories: cite the range source and the vendor advisory when explaining it. Report needs_review and partial coverage honestly and never call an empty, unresolved or partial result clean. Never send host names, IP or MAC addresses, user names or site names; such fields are stripped and listed under privacy.

Cheap repeat check. For devices you already checked with correlate_devices, send the same vendor, product and version plus the result_hash you kept. Returns which devices changed and their new hash; only changed devices need a fresh correlate_devices call. Use this for repeat checks. Never send host names, IP or MAC addresses, user names or site names.

Fix plan for one device: fix groups (which update clears which CVEs) and the fix plan (the single step that clears the known-exploited CVEs, and the one that clears everything fixable). Send vendor, product and version exactly as the inventory says. Says so plainly when the device did not resolve or coverage is partial. Never send host names, IP or MAC addresses, user names or site names.

Look up one CVE by id (for example CVE-2024-9137) and return BreachSpider's record, trimmed: severity, CVSS, known-exploited status, EPSS, fix status, vendor and CISA ICS advisories and links. It is not device specific; to know whether a device is affected, use correlate_devices.