Menu

Report a Cybersecurity Vulnerability

Advanced Electronics is committed to maintaining the security, safety, and reliability of our products. If you believe you have identified a cybersecurity vulnerability affecting an Advanced product, software application, or service, please report it to our Product Security Team at the email below.

Email:                       vulreporting@advancedco.com

Contact Details:     security.txt

Please Include:
  • Product name and version
  • Description of the vulnerability
  • Steps to reproduce the issue
  • Potential impact
  • Any supporting evidence (screenshots, logs, proof-of-concept, etc.)
  • Your contact details
Our Commitment

Upon receipt of your report, we will:

  • Acknowledge your submission.
  • Assess the validity and severity of the reported issue.
  • Request additional information if required.
  • Investigate and manage confirmed vulnerabilities through our Product Security Vulnerability Management Process.
  • Comply with applicable reporting obligations under the European Union Cyber Resilience Act (CRA).
Responsible Disclosure

We welcome reports from customers and other stakeholders and support responsible vulnerability disclosure. We ask that any vulnerabilities are reported directly to us and are not publicly disclosed until we have had a reasonable opportunity to investigate and address the issue.

Guidance

You MUST NOT:

  • Break any applicable law or regulations.
  • Access unnecessary, excessive or significant amounts of data.
  • Modify data in the organisation’s systems or services.
  • Use high-intensity invasive or destructive scanning tools to find vulnerabilities.
  • Attempt or report any form of denial of service, e.g. overwhelming a service with a high volume of requests.
  • Disrupt the organisation’s services or systems.
  • Submit reports detailing non-exploitable vulnerabilities, or reports indicating that the services do not fully align with “best practice”, for example missing security headers.
  • Submit reports detailing TLS configuration weaknesses, for example “weak” cipher suite support or the presence of TLS1.0 support.
  • Communicate any vulnerabilities or associated details other than by means described in the published security.txt.
  • Social engineer, ‘phish’ or physically attack the Organisation’s staff or infrastructure.
  • Demand financial compensation in order to disclose any vulnerabilities.


You MUST:

Always comply with data protection rules and must not violate the privacy of the Organisation’s users, staff, contractors, services or systems. You must not, for example, share, redistribute or fail to properly secure data retrieved from the systems or services.

Securely delete all data retrieved during your research as soon as it is no longer required or within 1 month of the vulnerability being resolved, whichever occurs first (or as otherwise required by data protection law).

Legalities

This policy is designed to be compatible with common vulnerability disclosure good practice. It does not give you permission to act in any manner that is inconsistent with the law, or which might cause the organisation or partner organisations to be in breach of any legal obligations.

Thank you for helping us improve the cybersecurity and resilience of our products.

Advanced Product Security Incident Response Team
Advanced Electronics Ltd.