TP-Link Product
Security Trust Center Center for product
vulnerability reporting, security bulletin and security news
Our
Commitments
TP-Link is
committed to delivering secure and reliable networking and smart home products.
Protecting our customers’ security and privacy is central to our mission.
We welcome coordinated reports of potential security vulnerabilities affecting
TP-Link products, services, firmware, software, mobile applications, cloud
services, and related components.
Report
Vulnerabilities to TP-Link Security researchers,
individuals, partners and organizations are encouraged to report potential
vulnerabilities directly to TP-Link Security Team. Please note: This
reporting channel is for security vulnerability reports only. For product setup,
troubleshooting, warranty, account, or general technical support issues, please use
TP-Link Technical Support.
Report
Method
Email
Secure
Reporting
How
TP-Link Deals with Vulnerabilities
Receipt
& Acknowledgment
Report received
and recordedInitial
completeness reviewReporter
acknowledgmentCase creation
and assignment
Triage
& Validation
Validate
vulnerability claimAssess
reproducibilityIdentify
affected products and versionsDetermine
preliminary severityRequest
additional information if neededRespond within
5 working days
Impact
& Scope Assessment
Confirm
affected products, firmware, software, cloud services, or
applicationsEvaluate
exploitability and riskAssess customer
exposureDetermine
remediation strategyAssign
remediation priority
Remediation
& Mitigation
Develop fixes
or mitigationsPerform
validation and testingCoordinate
release planningPrepare
customer guidanceReserve CVE
identifiers when appropriateTypically takes
up to 90 days or longer.
Publication
& Disclosure
Publish
security advisory where appropriateRelease fixes
or mitigationsPublish and
update CVE records where applicableCoordinate
disclosure with researchersCommunicate
customer guidance
Questions
and Answers
Who
can report vulnerabilities, and where should they go?
Security
researchers, individuals, partners, and organizations are encouraged to
report potential vulnerabilities directly to the TP‑Link Security Team
through the official vulnerability reporting channel.
Can
I use this channel for product support or troubleshooting?
How
quickly will TP‑Link acknowledge my report?
How
often will I get status updates on an open report?
What
might a status update include?
Will
TP‑Link ask me for more information?
Can
I submit vulnerability details securely?
What
principles should reporters follow?
What
are the stages of TP‑Link's vulnerability handling process?
When
does TP‑Link publicly disclose vulnerabilities?
When
might TP‑Link accelerate public disclosure?
Does
TP‑Link report vulnerabilities to regulators?
How
does TP‑Link prioritize vulnerability reports?
What
remediation does TP‑Link provide for supported products?
What
happens with legacy, end‑of‑life, or end‑of‑service products?
What
does TP‑Link recommend to customers?
Does
TP‑Link assign CVE IDs?
On
what basis does TP‑Link publish security advisories?