We place the highest importance on security matters and greatly appreciate input from security professionals to strengthen the security of our digital offerings, applications, and cloud services. Our strategy for addressing security vulnerabilities is based on an organized process. We are thankful for any identified vulnerabilities, regardless of service agreements or the development stage of our products and applications.
1. Recipient Action: Promptly monitor and allocate received vulnerabilities.
2. Verification Process: Validate the vulnerability, confirming its potential for exploitation and impact.
3. Solution Development: Offer effective solutions for fixes or measures to mitigate risks.
4. Scope Determination: Examine and verify the full range of products impacted.
5. Security Advisory Issuance: Assess and disseminate the security vulnerability advisory.
In accordance with the Vulnerability Disclosure Policy, we commit to acknowledge your reported vulnerability within 24 hours (Monday to Friday, 9am to 5pm EST) upon receipt of the initial submission. Once the reported security issue is verified based on its impact, severity, and the complexity of the potential concern, we will assign a Vulnerability Classification level and actions will be determined at that time. We may seek your ongoing assistance in addressing the vulnerability concern during the review and resolution period, up to 90 days, unless otherwise prohibited. Throughout this process, we will provide updates on progress bi-weekly until a resolution is in place. We kindly request that you treat the vulnerability as confidential and refrain from engaging in activities such as unauthorized denial of service attacks, load testing, social engineering, or other undesirable actions until a solution has been implemented.
Name/type of affected product/app/service, plus specific model number, serial number, etc.
Any Proof of Concept (POC) setup details
Description of the steps to reproduce the issue
Public references if there are any
*Note: Actual vulnerability response time may vary depending on the risk level and complexity of the vulnerability. Please check your spam folder if you haven’t heard from us.
1. Vulnerabilities of remote direct access to system permissions (server permissions, client permissions, intelligent devices), including but not limited to arbitrary code execution, arbitrary command execution, and uploading and adoption of Trojan horses.
2. Mobile terminal: vulnerabilities of remote code execution.
3. Device terminal: vulnerabilities causing a permanent denial of service on the device, including but not limited to permanent denial of service attack (the device can no longer be used: it is completely permanently damaged, or the entire system needs to be rewritten) initiated remotely by the system device, that physical contact with the device is not allowed during an attack, and that the attack needs to be replicated in batches quickly
1. Vulnerabilities directly leading to the disclosure of sensitive information of the online server, including but not limited to disclosure of source code of the core system, disclosure of information related to user account payment or the downloading of sensitive log files of the server.
2. Vulnerabilities that affect the normal operation of online services, such as denial of service of the application layer.
3. Logical design defects in the system, which can lead to unauthorized operation, such as unauthorized access to sensitive information.
1. General information disclosure, including but not limited to plaintext storage password of mobile client end, download of source code compressed package containing sensitive information of server or database, etc.
2. Logic design defects of the system, such as bypassing commodity postage, payment vulnerabilities, etc.
1. Vulnerabilities that can be exploited for phishing attacks, including but not limited to URL redirection vulnerabilities.
2. Logic design defects of the system.
3. Minor information disclosure vulnerabilities, including but not limited to path disclosure, .git file disclosure, and business log content of the service side.
1. Bug problems unrelated to security, including but not limited to slow opening of web pages and disordered styles.
2. The report submitted is too simple to be reproduced according to the report content, including but not limited to the vulnerabilities that cannot be reproduced through repeated communication with the vulnerability reviewer.
3. Products, APPs or modules not under maintenance
4. Vulnerabilities of general protocols such as WIFI, MQTT, BLE, and Zigbee
We offers you intelligent equipment management services through the Smart Life App to realize interlinkage among intelligent equipment. Service contents include intelligent equipment management, scene interlinkage and analysis report, etc. Such functions may be optimized or modified according to changes of users’ demands, and service supply may be updated/optimized due to regular and irregular maintenance for a period of 3 years from the date of original retail purchase.
