Milesight Vulnerability Reporting and Response Process

1. Our Approach to Security

At Milesight, cybersecurity is a fundamental aspect of our product and service design. We are committed to protecting our customers by proactively identifying and addressing security vulnerabilities. To ensure a collaborative security environment, we encourage security researchers, industry professionals, customers, and partners to report any security concerns they discover in our products and services.

2. Reporting a Security Vulnerability

2.1 How to Notify Us

If you identify a potential security vulnerability in a Milesight product or service, please contact our security response team directly. We have a structured process in place to review, assess, and resolve reported issues efficiently.

Subject Line Format: "Vulnerability Report – [Product Name] – [Brief Summary]"

2.2 Information Required in Your Report

For a thorough assessment and swift resolution, we request the following details:

• Your name, organization (if applicable), and contact information.
• A concise description of the vulnerability, including its category and potential impact.
• The affected product(s) and their version(s).
• Technical documentation, proof of exploitation, or a proof of concept (PoC), if available.
• Any recommendations for mitigating or resolving the issue.
• A proposed disclosure timeline, if applicable.

3. Our Vulnerability Handling Process

3.1 How We Respond to Reports

Milesight takes every vulnerability report seriously and follows a structured approach to resolving security concerns:

• 1.   Acknowledgment:  Within five business days, we will confirm receipt of the report and initiate an internal review.
• 2.  Assessment & Verification:  Our security team will analyze the reported issue, determine its severity, and validate its authenticity.
• 3.  Regular Status Updates:  Throughout the investigation and resolution process, we will provide periodic updates to the reporter to keep them informed of our progress.
• 4.  Remediation Plan:  We will develop and implement a resolution, which may include security patches, configuration changes, or other mitigation measures.
• 5.  Testing & Validation:  Before deployment, all fixes undergo rigorous testing to ensure their effectiveness and security compliance.
• 6.  Customer Notification & Disclosure:  Once a fix is available, we will notify affected parties and, when necessary, provide a public advisory with recommendations.

Remediation timelines are determined based on the severity and complexity of each reported vulnerability. Our goal is to remediate vulnerabilities as promptly as possible, with a target of completing remediation within 90 days of receiving a valid vulnerability report. For vulnerabilities affecting open-source components, remediation may require additional time due to dependencies on third-party information, patches, and/or validation.

4. Confidentiality and Responsible Disclosure

Milesight ensures that all reported vulnerabilities are handled with strict confidentiality. Information will only be shared with personnel whose involvement is necessary for the remediation process.

In accordance with the principles of Coordinated Vulnerability Disclosure (CVD), Milesight requests that security researchers refrain from publicly disclosing any vulnerability before the end of the 90-day disclosure period or another mutually agreed-upon date. Researchers are also expected to conduct vulnerability research within the bounds of applicable laws and in a manner that does not cause harm to Milesight, its partners, or its customers, compromise privacy, or put security at risk.

For more information about Coordinated Vulnerability Disclosure, please refer to the following resources:

• ISO/IEC 29147:2018 — Vulnerability Disclosure
• The CERT® Guide to Coordinated Vulnerability Disclosure

Milesight complies with applicable security and privacy laws and regulations and takes all reasonable measures to protect sensitive vulnerability information. Milesight will not disclose vulnerability details to third parties unless explicitly requested by the affected customer or required by law.

5. Our Commitment to Cybersecurity

Security is an ongoing priority at Milesight. We continuously strengthen our products and solutions by collaborating with security researchers and industry professionals. Every reported vulnerability is treated with urgency and diligence, ensuring that our customers receive secure and reliable products.

6. Security Update Commitment & Security Support Period

Milesight is committed to maintaining the security and integrity of its products throughout their lifecycle. We provide regular security updates to address vulnerabilities and enhance product safety.

• Security Support Period: Milesight provides security updates and patches for its products for a minimum of 5 years from the product's release date.
• Update Frequency: Security updates are released on a regular basis or as needed when critical vulnerabilities are identified.
• Notification Method: Users will be informed about security updates through official Milesight channels, including our website, security bulletins, and email notifications.

Security Support Period:

Cybersecurity Subscribe