Report Vulnerability

Introduction

This Vulnerability Disclosure Policy (VDP) defines the activities for security researchers to find and report vulnerabilities in IoT solutions including cloud services, mobile application and smart home appliances, Smart TVs and EVCs in a legally authorized manner. Security researchers can be any persons of any age or affiliation located anywhere in the World. This policy is effective as ofJan 3, 2024.

Overview

This policy is the "act of initially providing vulnerability information to a party that was not found to be previously aware." The individual or organization that performs this act is called the reporter or security researcher.

We, as Vestel Electronics Inc., consider security and privacy issues/vulnerabilities seriously and to improve/enhance the security level of our end2end IoT Solutions including mobile apps, back-end solutions and IoT devices such as home appliances, Smart TVs and EVCs. We gladly wait for feedback/report from security researches. If an information about potential vulnerabilities is reported to us, the VDP and incident response plan will be used in mitigate or remediate actions for the IoT solution related vulnerabilities.

Scope

All IoT devices including smart home appliances, Smart TVs, EVCs and related end2end IoT solutions including back-end systems, mobile applications are covered within the scope of the VDP.

Also, a researcher determines a vulnerability which includes any sensitive data (including personally identifiable information, financial information, or the proprietary information or trade secrets of any party), they must stop testing, notify relevant e-mail address immediately through our vulnerability submission process, and not disclose this data to anyone else. If a researcher engages in any activities that are inconsistent with this procedure or other applicable law, the researcher may be subject to criminal and/or civil liabilities.

Guidelines

Under the VDP, researchers should take the activities required that:

• If  a vulnerability is discovered or sensitive data such as personally identifiable information (PII), financial information is identified,the security researcher should stop testing and notify Vestel.
• When personal data is discovered, the security researcher specifies the type of PII in the report.Any spesific PII should not be given in the reported vulnerability. Please send an email topsirt@vestel.com.trthe information and reports 
• Security researchers shall report potential vulnerabilities identified in the end2end IoT Solutions and IoT devices via e-mail:psirt@vestel.com.tr. For reports submitted in compliance with this policy, the team will acknowledge receipt within five (5) business days. 
• Security researchers make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or manipulation of data.
• Security researchers must only use exploits to the extent necessary to confirm a vulnerability's presence. Security researchers must not use an exploit to compromise or exfiltrate data, establish persistent command line access, or use the exploit to pivot to other systems.
• Security researchers should not submit a high volume of low-quality reports.
• Security researchers may not send encrypted emails at this time.
• Security researchers provide us a reasonable amount of time (90 calendar days) to resolve the issue before disclosing it publicly.

A vulnerability report shall include the following information:

• Affected product type, model, version.
• Detailed description of the vulnerability.
• Information about data breach if any.
• Setup and reproduction steps.
• Network traces (if available).
• Public references of vulnerability if it is known issue.

In addition, we count the following activities as strictly prohibited or out of scope, and thus not rewardable:

• Social Engineering attacks
• Clickjacking on pages without any authentication and/or sensitive state changes
• Content spoofing
• HTTP Header related test results
• DoS/DDoS
• Results of automated vulnerability / scanning tools
• Brute forcing