Skip to content
Security

Vulnerability disclosure

The process by which security researchers report flaws to a manufacturer and the manufacturer acknowledges, fixes and communicates them, ideally under a published policy.

A coordinated vulnerability disclosure (CVD) policy tells researchers where to send a report, promises a response within a reasonable time, and commits to not pursuing legal action against good-faith research. The manufacturer triages the report, develops a fix, ships it through its OTA update channel and publishes an advisory, usually with a CVE identifier. ISO/IEC 29147 and 30111 describe the process.

For IoT vendors this is no longer optional: ETSI EN 303 645 and the UK PSTI Act both require a public point of contact for reporting vulnerabilities. Beyond compliance, a working disclosure process is how a company learns about problems before attackers exploit them, and a hostile one guarantees that researchers go public instead.

Part of the IoT Glossary. Spotted an error or a missing term? Tell us.