Product Security Advisory

Product Security Policy

CyberPower follows an internal vulnerability handling and risk assessment process. Upon receiving vulnerability details, CyberPower will review and validate the report, assess its potential impact and severity, identify affected products or versions where applicable, and prioritize remediation or mitigation based on risk. CyberPower will communicate with the reporter during the validation and assessment process and provide updates on remediation or mitigation status when appropriate. Please note CyberPower may not be able to evaluate submissions that are incomplete or that do not include the information requested.

For validated and reportable security vulnerabilities, once an appropriate remediation or mitigation measure has been identified, CyberPower will disclose relevant information through appropriate channels, such as security advisories, release notes, firmware/software updates, or mitigation guidance. Such disclosure may include a description of the vulnerability, its severity and impact, a CVSS score or a score based on a similar vulnerability rating system, affected products and versions, a description of the resolution, and details of any security update or other corrective measure made available. Where available, the disclosure may also include information concerning any malicious actor that has exploited or is exploiting the vulnerability.

Where required by applicable laws or regulations, including but not limited to the EU Cyber Resilience Act (CRA), CyberPower will submit the required vulnerability or incident notifications to the designated competent authorities in accordance with the applicable legal requirements. For actively exploited vulnerabilities, such notifications may include information about the affected product, the general nature of the vulnerability and its exploitation, corrective or mitigating measures taken or available to users, the sensitivity of the notified information, and, where applicable, the EU Member States in which CyberPower is aware that the product has been made available. The timing of such notifications will be handled in accordance with applicable regulatory requirements.

The availability and timing of updates may vary depending on factors such as the potential impact of the vulnerability, whether the vulnerability has been publicly disclosed, whether known exploits are available, the scope of affected products, and whether effective mitigations are available. Not all reported concerns will be confirmed as vulnerabilities, and CyberPower does not guarantee a specific resolution for every report. This policy and advisory apply to all products, services, and digital assets developed, maintained, or operated by CyberPower. Third-party products or services not developed or managed by CyberPower are outside the scope of this policy and advisory.CyberPower reserves the right to modify this policy at any time at its sole discretion without further notice. We encourage you to monitor this page regularly to ensure timely implementation of security updates.