Vulnerability Disclosure
PREFACE
ZOLON Technology Limited (hereinafter referred to as "ZOLON", we, us or our) is committed to improving the security of our products and services to fully support the secure operations of our customers' networks and services. We encourage security researchers, industry organizations, customers, and suppliers to report to us the suspected vulnerabilities associated with publicly accessible assets of ZOLON. ZOLON has established a process for handling reported suspected vulnerabilities.
Security researchers shall place our users' interests at the forefront and respect the privacy of users. ZOLON encourages the interest parties to discover and report vulnerabilities legally and commits to working with security researchers to understand, confirm, and appropriately resolve the vulnerability. Vulnerability information shall not be disclosed by you to anyone outside ZOLON before being submitted to ZOLON. Without ZOLON's written consent, any disclosure to the public would violate the terms and conditions of this Program.
ZOLON urges the reporting party to follow the Responsible Disclosure Policy, which involves privately notifying us of any security vulnerabilities before fully disclosing them to allow us to resolve the vulnerabilities and minimize any overall risk to users. During the entire process, ZOLON will strictly control the scope of information distribution. ZOLON will request the reporting party to keep the vulnerability confidential until ZOLON has completed the fix.
HANDLING PROCESS
1. Identify
To report a potential vulnerability affecting a ZOLON product or solution, please contact ZOLON using the methods described in the CONTACT INFORMATION section.
Particularly, if you need to report a potential vulnerability please include the word [VULNERABILITY] in the subject line. If the report submitted by you is incomplete, incorrect, duplicate or false, ZOLON will not handle it.
Required Information (Please using the template for reporting suspected vulnerabilities):
- Where the device was acquired;
- Affected product/service, including model name, serial number (SN), hardware version (PN), OS or software version;
- Summary of the vulnerability, including issue description, type of vulnerability;
- The impact (arbitrary code execution, information disclosure, etc.) and severity estimate;
- Technical details, procedures for reproducing the issue;
- Proof-of-Concept (PoC) or other substantial evidence;
- Vulnerability attack scenario description, including prerequisites for the attack, trigger conditions, and whether interaction with the victim is required;
- Recommendations for mitigation.
ZOLON usually responds to complete and correct reports submitted by you within 5 working days. If a reply email is not delivered, please make sure the email from ZOLON has not been marked as junk.
2. Verify
ZOLON investigates and reproduces the potential issue.
Generally, the verification process can be completed within 10 working days. Considering the complexity of potential issues, this period may be extended by 1 month where necessary.
3. Remediation
ZOLON performs internal vulnerability handling in collaboration with the responsible security and development groups, and will maintain vulnerability mitigation and recovery plans for any affected products or solutions.
The duration of this phase will vary in accordance with the risk level, impact and difficulty.
4. Release
If applicable, patches or fixes will be available via normal release channels.
CONTACT INFORMATION
Please contact ZOLON at VulnerabilityDisclosure@szzolon.com
Please note that only emails sent in English or Chinese can be considered.
Use the Public PGP key (Key ID 21B0 226B; Fingerprint: D0E2 92E3 C558 C441 C31A E973 EFDB 5A1C 21B0 226B) to encrypt your report.
DISCLAIMER
Notwithstanding any terms and conditions mentioned above, for the purposes of identifying and assessing a vulnerability report, including but not limited to the effectiveness of the vulnerability, the eligibility of a report, and the severity level of the vulnerability, ZOLON reserves the right of final interpretation. Meanwhile, ZOLON reserves the right to pursue legal actions against illegal testing and disclosing actions in accordance with the applicable laws and regulations.