Icotera Vulnerability Disclosure Policy

1: Owner information

Icotera Vulnerability Disclosure Policy

Objective:

At Icotera we are committed to providing CPE products that allow its customers to easily and effectively protect their users and their network from malicious actions.

This is done by ensuring the security of our Consumer Premises Equipment (CPE) products software and configuration recommendations.

This Vulnerability Disclosure Policy outlines the procedures for security researchers and individuals to responsibly report potential vulnerabilities in our products.

Icotera PSIRT

Issues relating to product security are handled by the Icotera Product Security Incident Response Team (PSIRT).

Scope:

Where to send your report:

– Product vulnerabilities and security incidents – psirt@icotera.com – Use this address for any suspected vulnerability or security weakness in an Icotera CPE product, its firmware or an associated service, and for any security incident affecting an Icotera product in operation. It is Icotera’s single point of contact for these reports and is monitored by the PSIRT.

• Describe which model and firmware version have been investigated.
• Include a detailed description of the vulnerability, along with steps to reproduce it.
• Attach any necessary supporting documentation (e.g. screenshots, proof-of-concept code).
• If you are reporting an incident rather than a finding, add when you first observed it, roughly how many devices appear affected, and which network or deployment is concerned.

– All other security matters – security@icotera.com – Use this address for security questions and concerns that do not relate to an Icotera product — for example, our website, our corporate IT, or e-mails and domains impersonating Icotera.

– If you are not sure which applies, write to psirt@icotera.com. We would far rather receive a report at the wrong address than not receive it at all, and we route it internally. A report sent to security@icotera.com that turns out to concern one of our products is passed to the PSIRT and handled under this policy.

Encryption:

– Encrypt your email using our PGP key to ensure the confidentiality of the communication.

Provide Contact Information:

– Include your contact information, including your name and email address.

Response Time:

– Icotera is committed to acknowledging receipt of your report within 72 hours.

– We will provide regular updates on the status of the investigation.

– Registering a report is not in itself a confirmation that a vulnerability exists.

Responsible Disclosure Guidelines:

– Security researchers are expected to make reasonable efforts to avoid privacy violations, service disruptions, and destruction of data during their research.
– Do not disclose the vulnerability to the public or any third parties until Icotera has had a reasonable time to address the issue.

Our Commitment:

– Icotera is committed to working with security researchers to understand and address reported vulnerabilities promptly.

– We will provide public credit and recognition to the security researcher, with their consent, upon successful resolution of the vulnerability.

Legal Safe Harbor:

– Icotera will not pursue legal action against individuals who discover and report vulnerabilities in accordance with this policy.

Exceptions:

– This policy does not grant permission to engage in any activities that could harm Icotera or its customers.
– Icotera reserves the right to update this policy at any time without notice.

Contact Information:

– For any questions or concerns regarding this policy, please contact security@Icotera.com.

PGP Key:

– Icotera PGP key can be found here.

Thank you for helping us keep our products secure!
Icotera Security Team

Committed support dates: