Network built for the next era.
TP-Link Product Security Trust CenterCenter for product vulnerability reporting, security advisory disclosure and security recourse
Our Commitments
TP-Link is committed to delivering secure and reliable networking and smart home products. Protecting our customers’ security and privacy is central to our mission. We welcome coordinated reports of potential security vulnerabilities affecting TP-Link products, services, firmware, software, mobile applications, cloud services, and related components.
Report Vulnerabilities to TP-LinkSecurity researchers, individuals, partners and organizations are encouraged to report potential vulnerabilities directly to TP-Link Security Team.Please note: This reporting channel is for security vulnerability reports only. For product setup, troubleshooting, warranty, account, or general technical support issues, please use TP-Link Technical Support.Report a vulnerability
Report Method
Email
Secure Reporting
How TP-Link Deals with Vulnerabilities
Receipt & Acknowledgment
Report received and recordedInitial completeness reviewReporter acknowledgmentCase creation and assignment
Triage & Validation
Validate vulnerability claimAssess reproducibilityIdentify affected products and versionsDetermine preliminary severityRequest additional information if neededRespond within 5 working days
Impact & Scope Assessment
Confirm affected products, firmware, software, cloud services, or applicationsEvaluate exploitability and riskAssess customer exposureDetermine remediation strategyAssign remediation priority
Remediation & Mitigation
Develop fixes or mitigationsPerform validation and testingCoordinate release planningPrepare customer guidanceReserve CVE identifiers when appropriateTypically takes up to 90 days or longer.
Publication & Disclosure
Publish security advisory where appropriateRelease fixes or mitigationsPublish and update CVE records where applicableCoordinate disclosure with researchersCommunicate customer guidance
Questions and Answers
Who can report vulnerabilities, and where should they go?
Security researchers, individuals, partners, and organizations are encouraged to report potential vulnerabilities directly to the TP‑Link Security Team through the official vulnerability reporting channel.
Can I use this channel for product support or troubleshooting?
How quickly will TP‑Link acknowledge my report?
How often will I get status updates on an open report?
What might a status update include?
Will TP‑Link ask me for more information?
Can I submit vulnerability details securely?
What principles should reporters follow?
What are the stages of TP‑Link's vulnerability handling process?
When does TP‑Link publicly disclose vulnerabilities?
When might TP‑Link accelerate public disclosure?
Does TP‑Link report vulnerabilities to regulators?
How does TP‑Link prioritize vulnerability reports?
What remediation does TP‑Link provide for supported products?
What happens with legacy, end‑of‑life, or end‑of‑service products?
What does TP‑Link recommend to customers?
Does TP‑Link assign CVE IDs?
On what basis does TP‑Link publish security advisories?