Vulnerability Response and Disclosure Process

Recipient:
Monitor and and assign received vulnerabilities in a timely manner
Verification:
Verify the vulnerability and confirm the exploitability and impact
Solution Development:
Provide effective fix solutions or risk remediations measures
Affected Scope Confirmation:
Investigate and confirm the complete scope of affected products
Affected Scope Confirmation:
Review and publish the security advisory for the security vulnerability

Report Vulnerabilities

You can report the discovered security vulnerabilities of SOLARMAN smart hardware products through the following method.

Mailbox

The email should include at least the following information:

  • - Your organization and contact information
  • - Products and versions affected
  • - Description of the potential vulnerability
  • - Information about known exploits
  • - Disclosure plans
  • - Additional information, if any
Attention Although we encourage investigation of potential security breaches, we cannot tolerate any activity that may interfere with legitimate users or may violate applicable computer abuse, cyber security and data protection regulations. Therefore, the following activities are prohibited: - Modification or destruction of data - Service disruption or degradation, such as DoS - Disclosure of personal, proprietary or financial information - Disclosure of vulnerabilities before SOLARMAN publishes an official security bulletin

Attention

Although we encourage investigation of potential security breaches, we cannot tolerate any activity that may interfere with legitimate users or may violate applicable computer abuse, cyber security and data protection regulations. Therefore, the following activities are prohibited:

  • - Modification or destruction of data
  • - Service disruption or degradation, such as DoS
  • - Disclosure of personal, proprietary or financial information
  • - Disclosure of vulnerabilities before SOLARMAN publishes an official security bulletin

Response Time

1) General Vulnerabilities (Coordinated Disclosure)​
For vulnerabilities you submit, we will provide an initial response within 48 hours of receipt. Once internally confirmed as a security vulnerability, we will complete verification, remediation or provide mitigation measures and publish a security advisory within 90 days in principle. The actual timeline may be adjusted based on the risk level, complexity, and product scope involved. Critical/High severity vulnerabilities will be prioritized, and interim mitigation measures may be released in advance where appropriate.

2) Mandatory CRA Regulatory Reporting (applicable only to products placed on the EU market and falling within the scope of the EU Cyber Resilience Act)
If the relevant vulnerability or incident meets any of the following criteria, upon reaching the “awareness” threshold, we will submit a report via the ENISA Single Reporting Platform (SRP) to the competent CSIRT of the Member State where our main establishment is located, with a copy to ENISA. For products made available in other Member States, the receiving CSIRT will distribute the report as needed:
There is reliable evidence that the vulnerability has been actively exploited by malicious actors in real-world systems; or​
A severe security incident has occurred that has an actual adverse impact on product security (confidentiality, integrity, availability, authenticity).

Timelines:
Early Warning: submitted within 24 hours of awareness, including product identification, version, preliminary impact assessment, affected Member States, and any known exploitation information.​
Main Notification: submitted within 72 hours of awareness, supplementing details such as the nature of the vulnerability/incident, initial severity assessment, affected scope, and measures taken or proposed mitigation.
Final Report: for actively exploited vulnerabilities, submitted within 14 days after a patch or mitigation becomes available; for severe security incidents, submitted within one month after the 72-hour main notification. The final report includes root cause analysis, severity, impact, remediation/security update details, and follow-up actions.

The above regulatory reporting obligations do not replace our obligation to notify affected users/customers of risks and mitigations. Submitting a Proof-of-Concept (PoC) by a white-hat researcher within an authorized testing scope shall not be deemed as “active exploitation”.