PSIRT Policy
The Noxium Product Security Incident Response Team (PSIRT) handles the receipt, analysis, remediation and disclosure of vulnerabilities affecting our products and services.
Vulnerability management process
We follow international best practices for coordinated vulnerability disclosure (CVD), based on ETSI TR 103 838 and ISO/IEC 29147.
- 01
Report
The researcher sends a detailed report of the vulnerability through our secure channel.
- 02
Acknowledgement
We confirm receipt of the report within a maximum of 3 business days.
- 03
Assessment
Our security team analyses and validates the reported vulnerability.
- 04
Coordination
We keep the researcher informed about progress and resolution times.
- 05
Remediation
We develop and deploy the necessary fixes in our products.
- 06
Disclosure
We coordinate the publication of the vulnerability with the researcher once it has been fixed.
Timelines of our internal process
| Report received | Immediate | The report is received securely and handled with strict confidentiality. |
|---|---|---|
| Acknowledgement | 3 business days | Confirmation with a unique identifier that must be used in all further communications. |
| Initial assessment | 7-10 business days | Validation of the vulnerability, severity and estimated resolution time. |
| Regular updates | Every 14 days | Information on milestones reached and estimated patch release dates. |
| Resolution and disclosure | Depends on severity | Disclosure date agreed with the researcher, leaving customers time to update. |
Vulnerability reporting channels
To report a vulnerability, please contact our security team:
Please include “[VULNERABILITY]” in the email subject.
You can also contact us through our company page:
We reply during business hours (Mon-Fri, 9:00-18:00 CET).
Information required in the report
| Vulnerability description | A clear and detailed description, including the type (SQL injection, XSS, buffer overflow, etc.). | |
|---|---|---|
| Affected product and version | Product name, specific model and firmware or software version. | |
| Steps to reproduce | Step-by-step instructions, with the required configuration and specific conditions. | |
| Impact and severity | Potential impact on confidentiality, integrity and availability, and estimated severity. | |
| Technical details | Logs, screenshots, proof of concept (PoC), captured network traffic, etc. | |
| Researcher information | Name or alias, contact details and public acknowledgement preferences (optional). | |
Response and disclosure policy
Scope
We accept vulnerability reports for the following products and services:
Raxon routers
Industrial routers for electrical telemetry infrastructures.
Axom modems
4G modems for IoT communications in industrial environments.
RMU-Aqua gateways
NB-IoT gateways for low-power sensor networks.
Sócrates platform
Cloud platform for IoT data management and analysis.
NoxApp
Android mobile app for monitoring and control.
Response policy
We confirm receipt within a maximum of 3 business days, carry out an initial assessment within 7-10 business days and keep the researcher informed every 14 days until resolution.
Coordinated disclosure and embargo
We ask for a minimum period of 90 days from the initial report before any public disclosure. The publication date is agreed with the researcher, allowing a reasonable period for customers to update their systems.
Recognition
- Hall of Fame. Researchers who report valid vulnerabilities are included, with their consent, in our security Hall of Fame.
- Advisory credits. Security advisories credit the researcher, respecting their anonymity or alias preferences.
- Transparent communication. We keep open communication throughout the whole process.
Reference standards
- ETSI TR 103 838. Guide to coordinated vulnerability disclosure for IoT products.
- ISO/IEC 29147. International standard for vulnerability disclosure.
- INCIBE-CERT. CVD resources from the Spanish national Computer Security Incident Response Team.
- CVSS. Scoring system for assessing the severity of vulnerabilities.
The timelines given are indicative and may vary depending on the complexity and severity of each case.
Data protection and confidentiality
Responsible handling
We do not share the researcher’s personal data or technical details with third parties without explicit consent, except where necessary to resolve the issue.
Regulatory compliance
Personal data is processed in accordance with the GDPR and applicable Spanish legislation, solely to manage the report and the agreed acknowledgement.
Data retention
Information is kept for as long as necessary to manage the case and meet legal obligations. You may request the deletion of your data once the case is closed.
Secure communications
For particularly confidential information we can arrange the use of PGP encryption or other secure communication methods.
Security statement
Recommended practices
- Report vulnerabilities responsibly and confidentially.
- Provide detailed information to make reproduction easier.
- Allow reasonable time for a fix before public disclosure.
- Act in good faith and avoid actions that could damage our systems or data.
- Respect the privacy of our customers and users.
- Keep testing to the minimum needed to demonstrate the vulnerability.
Prohibited activities
- Accessing, modifying or deleting data that does not belong to you.
- Carrying out denial-of-service attacks (DoS/DDoS).
- Testing customers’ production systems without authorisation.
- Publicly disclosing the vulnerability before it is resolved.
- Social engineering against employees or customers.
- Attempting extortion or requesting financial compensation.
Noxium reserves the right of final interpretation of this policy.
Frequently asked questions
Do you offer financial rewards for vulnerabilities?
We do not currently have a bug bounty programme with financial rewards. We publicly acknowledge researchers’ contributions and value their help in improving the security of our products.
What should I do if I find a critical vulnerability that is being actively exploited?
Contact security@noxium.es immediately with “URGENT” in the subject. We will prioritise these cases and respond as quickly as possible.
Can I test on production devices?
No. Testing must only be carried out on devices you own or in authorised test environments.
How long should I wait before publicly disclosing a vulnerability?
We ask for a minimum period of 90 days from the initial report to develop, test and deploy fixes. For critical vulnerabilities we will work to shorten this period, and we will always coordinate disclosure with the researcher.
What do I need to access test devices?
If you need specific hardware to validate a vulnerability, contact our security team. We will assess each case and, where possible, provide test devices or additional technical information.
Do you accept reports about third-party products that integrate your devices?
The programme only covers products developed by Noxium. If the vulnerability affects third-party components, please report it to the relevant manufacturer; we would appreciate it if you also let us know so we can assess the impact on our products.
Ready to report a vulnerability?
Thank you for contributing to the security of our products and customers.
Send report