Purpose
BIXOLON is committed to the continuous improvement of the security of its products. We welcome reports of potential security vulnerabilities from security researchers, customers and users. This policy describes how to report a vulnerability in a BIXOLON product and how BIXOLON handles and discloses reported vulnerabilities.
Scope
This policy applies to:
- Receipt printers, mobile printers, label printers and related hardware products manufactured and sold by BIXOLON
- Firmware for the above products
- Drivers, utilities, SDKs and mobile applications distributed by BIXOLON
- Websites and online services operated by BIXOLON
The following are out of scope:
- Products and software that have reached end of support (the end-of-support list is published separately)
- Products and services manufactured or operated by third parties
- Attacks requiring physical access, theft or loss of a device
- Social engineering and phishing directed at BIXOLON employees
- Configuration recommendations and informational findings with no demonstrable security impact
How to Report
Please report vulnerabilities to:
Report a Vulnerability(NOTE: By Clicking on the link above you will be connecting to BIXOLON’s external site www.Bixolon.com)
Including the following information helps us validate your report quickly:
- Affected product name and model number
- Firmware or software version
- Type of vulnerability and a detailed description
- Steps to reproduce, with proof-of-concept code or screenshots where applicable
- Expected impact and attack scenario
- Your contact details and whether you wish to be credited
- Your intended publication date, if you plan to publish
Reports are accepted in English or Korean.
Our Process and Response Times
After receiving a report, BIXOLON will:
- Acknowledge receipt within 3 business days.
- Provide an initial assessment, including whether we consider the finding a vulnerability and our preliminary severity rating, within 10 business days.
- Provide a status update every 30 days while remediation is in progress.
- Notify you when a fix or mitigation has been released.
Remediation time depends on the severity of the vulnerability, the range of affected products and the validation required. BIXOLON aims to resolve high-severity vulnerabilities within 90 days of the initial report and, where an immediate fix is not feasible, to provide mitigation guidance first. These are target timeframes, not guarantees.
Disclosure
- BIXOLON follows coordinated disclosure. We publish information about a vulnerability after a fix or mitigation has been made available to users.
- The disclosure date is agreed with the reporter and, absent exceptional circumstances, occurs within 90 days of the initial report.
- Where we consider that publication would create additional risk for users before they are able to apply a fix, we may delay disclosure until users have had the opportunity to do so. We will explain our reasoning to the reporter.
- Published security advisories include the affected products and versions, a description of the vulnerability, its severity, and the action users should take.
- We credit reporters in our advisories where they wish to be credited, and respect requests to remain anonymous.
Guidelines for Researchers
When investigating and reporting vulnerabilities, please:
- Test only on devices you own or are explicitly authorised to test.
- Do not access, store, transfer or use the personal data of others. If you encounter such data, stop immediately and tell us in your report.
- Do not disrupt services, destroy data or degrade system performance.
- Limit your activity to what is necessary to demonstrate the vulnerability.
- Do not disclose or share vulnerability information with third parties before coordinating with BIXOLON.
- Do not demand payment or other consideration in exchange for the vulnerability information.
Safe Harbour
If you investigate and report a vulnerability in good faith and in accordance with Section 6 of this policy, BIXOLON considers your activity authorised. We will not initiate or support civil or criminal action against you in respect of that activity. If a third party brings legal action against you in connection with research conducted under this policy, we will make it known that your activity was carried out in accordance with this policy.
This section applies to the extent permitted by applicable law and does not apply to activity that breaches Section 6.
Rewards
BIXOLON does not currently operate a monetary bug bounty programme. We recognise reporters by crediting them in our security advisories.
Reporting to Authorities
Under the EU Cyber Resilience Act and other applicable law, BIXOLON is required to notify the relevant authorities of actively exploited vulnerabilities and severe security incidents. Where such notification is required, we will make it within the statutory deadlines.
We will not include a reporter’s personal data in such notifications without their consent.
Changes to This Policy
This policy may be revised in response to changes in applicable law and our operational experience. Revisions will be published on this page together with the revision date.