Vulnerability Response Process

ROYPOW Vulnerability Management Principles

One of our strategic priorities is to drive the ongoing development and effective implementation of a comprehensive "end-to-end cybersecurity assurance framework." In line with this, we have put in place a robust and sustainable vulnerability management system that encompasses policies, organizational structures, operational processes, governance mechanisms, technical measures, and compliance specifications. At the same time, we remain committed to openly engaging with external stakeholders to jointly address emerging security challenges.

To further demonstrate our commitment and clarify our strategic direction in vulnerability management, we have established the following five core principles to guide our actions:

1. Harm and risk reduction

Reducing or eliminating the harm and security risks caused to customers and users by ROYPOW product or service vulnerabilities is our vision for vulnerability management — and the guiding principle we follow in handling and disclosure.

2. Vulnerability reduction and mitigation

Despite the industry consensus that vulnerabilities are inevitable, we remain committed to: (1) taking proactive measures to reduce vulnerabilities in our products and services; (2) promptly delivering risk mitigations to customers and users once vulnerabilities are identified.

3. Proactive management

Vulnerabilities need to be addressed jointly with upstream and downstream partners throughout the supply chain. We proactively identify our vulnerability management responsibilities and requirements, including applicable laws and regulations governing business operations, contractual requirements, and applicable public standards, and establish a system to manage vulnerabilities proactively.

4. Continuous optimization

Threats constantly evolve, and cybersecurity requires defenders to keep innovating. We will continue to refine our vulnerability management processes and standards, learn from industry best practices, and improve our vulnerability management maturity.

5. Openness and collaboration

We will remain open and cooperative, strengthening our ties with the supply chain and the broader security ecosystem, including upstream and downstream partners, security researchers, security companies, and regulators. In our vulnerability management efforts, we will scale up stakeholder collaboration and build reliable partnerships.

In compliance with these principles and relevant industry standards, we have established a robust vulnerability management process. We uphold our responsibilities and strive to protect customers and reduce risks from vulnerability exploitation.

Vulnerability Handling Process

We are committed to improving product security to support the secure operation of our customers' networks and services. We have always prioritized vulnerability management throughout product development and maintenance, and have established a robust handling process aligned with relevant industry standards to ensure timely response and continuous security improvement.

1.Vulnerability awareness: Receive and collect suspected product vulnerabilities.

2.Validation & assessment: Confirm the validity and impact scope of suspected vulnerabilities.

3.Vulnerability remediation: Develop and implement remediation solutions for vulnerabilities.

4.Remediation information release: Release vulnerability remediation information to customers.

5.Closed-loop improvement: Make continuous improvement based on customers' feedback and practices.

Meanwhile, we proactively monitor well-known public vulnerability databases, open source communities, security websites, and other sources to swiftly detect vulnerabilities related to ROYPOW products. We manage all suspected vulnerabilities that are known to us and investigate the impact on all product versions that have not reached the end of service & support (EOS). Based on industry best practices, we strongly recommend that customers regularly review the availability of product support to ensure that they are entitled to software updates.

Getting aware of vulnerabilities promptly is a critical prerequisite for timely response. We encourage security researchers, industry organizations, customers, and suppliers to proactively report suspected vulnerabilities to our PSIRT, and require upstream suppliers to promptly report vulnerabilities in their deliverables to us. Meanwhile, we proactively monitor public vulnerability databases, open source communities, security websites, and other sources to stay aware of issues related to ROYPOW products. We track all suspected vulnerabilities reported to us and assess their impact on all product versions that are still under support. Following industry best practices, we strongly recommend that customers regularly check their product support status to stay eligible for software updates.

After receiving a suspected vulnerability, our PSIRT works with the relevant product team to analyze and validate the vulnerability, assess its severity based on its actual impact on the affected products, determine its remediation priority, and develop appropriate remediation measures, including mitigations, patches or updated versions, and other risk mitigations that customers can implement. Guided by the principles of harm and risk reduction, we disclose vulnerability information to relevant stakeholders and help customers assess the actual risks that vulnerabilities may pose to their networks.

When vulnerabilities are discovered in products or services provided by suppliers during product development, delivery, or deployment, we will proactively contact the relevant suppliers to coordinate vulnerability remediation. For vulnerabilities in open source software, we comply with the vulnerability management policies of the relevant open source communities, submit suspected vulnerabilities to the communities, support the timely release of remediations, and actively contribute our remediation efforts to the communities.

Our PSIRT will coordinate with the reporters to address the vulnerabilities. We may act as a coordinator or engage a third-party coordination center to facilitate the sharing of vulnerability information with other vendors and standards organizations and promote vulnerability resolution. If a vulnerability involves standard protocols, we recommend that reporters notify the relevant industry organizations when reporting the vulnerability to our PSIRT.

Guided by the principle of continuous optimization, we will continuously enhance our product security and vulnerability handling processes.

Throughout the vulnerability handling process, our PSIRT strictly ensures that vulnerability information is shared only with relevant parties involved in the handling process. We sincerely request that you keep the information confidential until a complete solution is available to our customers.

We will take necessary and reasonable measures to protect the data we obtain in accordance with applicable legal and compliance requirements. We will not proactively share or disclose such data to any third party unless otherwise required by law or requested by the affected customer.

Vulnerability Severity Rating

We assess the severity of suspected vulnerabilities in our products based on industry standards, such as the Common Vulnerability Scoring System (CVSS). CVSS consists of four metric groups: Base, Threat, Environmental, and Supplemental. We encourage end users to assess the Environmental score based on their specific network conditions. This score serves as the final vulnerability score for the specific environment and supports decision-making on vulnerability mitigation and deployment.

We use Security Severity Rating (SSR) as a simplified approach to vulnerability classification. Under SSR, vulnerabilities are classified as critical, high, medium, low, or informational based on their overall severity scores.

Third-Party Software Vulnerability

Considering the various scenarios in which third-party software or components are integrated into our products, we will adjust their vulnerability scores based on the specific integration scenarios to reflect the actual impact of the vulnerabilities. For example, if an affected module in third-party software or a component is not called, the vulnerability is considered “not exploitable and has no impact.” If a dimension is not covered by the existing assessment system, ROYPOW will be responsible for interpreting the assessment results.

We consider a vulnerability to be high-profile when all of the following conditions are met:

The CVSS score is 4.0 or above.
It has attracted widespread public attention.
The vulnerability is likely to be exploited, has already been exploited, or may be exploited in the wild.

For a high-profile third-party vulnerability, we will investigate all product versions that have not reached EOS and release a Security Notice (SN) after the vulnerability is confirmed as high-profile. The SN will notify relevant customers of the vulnerability handling progress. When a vulnerability mitigation is available, we will release a Security Advisory (SA) to support customers in making risk decisions and implementing mitigation measures. For third-party vulnerabilities that are not classified as high-profile, we will describe them in Release Notes (RNs).

Vulnerability Bulletins

Publications

We publish vulnerability information and remediations through the following publications:

Security Advisory (SA): An SA provides information about the remediation, including details such as the vulnerability severity, service impact, and remediation measures. Critical and high-risk vulnerabilities directly related to ROYPOW products, along with the corresponding remediations, are disclosed through SAs.
Security Notice (SN): SNs address public security topics related to products, including vulnerability-related and other security topics. Information about issues with an SSR of informational, such as issues discussed in blogs, discussion lists, or other public forums, is released through SNs. In addition, SNs may be used to notify customers of our vulnerability response progress in certain scenarios, for example, when a vulnerability in a ROYPOW product version has attracted widespread public concern or has been detected in exploits in the wild.
Release Note (RN): RNs contain information about patched vulnerabilities. An RN is part of the deliverables provided with a product version or patch and describes vulnerabilities with an SSR of medium or low.

Channels

ROYPOW releases SAs and SNs to keep customers informed of vulnerability remediation. RNs are part of the deliverables provided with a product version or patch, and customers can obtain them together with the corresponding product version or patch.

Plan

If one or more of the following conditions are met, we will release an SN or SA to support customers in making decisions about risks to live networks.

The vulnerability has an SSR of critical or high. We have completed the vulnerability response process and can provide a remediation solution to support customers in mitigating the risk on their live networks.
When a vulnerability in a ROYPOW product version may attract widespread public attention, or when ROYPOW has observed that the vulnerability is being actively exploited and may increase the risks faced by customers, ROYPOW will accelerate the response process, release an SN after confirming that the above conditions are met, and continuously update them on the vulnerability response progress.
To minimize global cybersecurity risks, we adhere to the Coordinated Vulnerability Disclosure (CVD) policy when coordinating disclosure schedules with third parties.

Disclaimer & Rights Reserved

We reserve the right to modify or update this document at any time as necessary to enhance transparency or enable a more effective response. Examples of updates include: