The time for completing a vulnerability response process depends on the scope of the vulnerability.

If you report a vulnerability to ZTE, we assume that you agree to keep the information confidential before ZTE discloses the information. Likewise, ZTE is committed to keeping the sensitive information secret for customers before repairing and disclosing the vulnerability.

ZTE uses the CVSSv3 to score and rate each vulnerability. Reporters can also score/rate vulnerabilities for our reference.

ZTE uses CVE (Common vulnerabilities and Exposures) and CWE (Common Weakness Enumeration) to quote public vulnerabilities outside ZTE’s official website.

ZTE reserves the rights for releasing vulnerability reports.

Insisting on the principle of being open and transparent, ZTE ensures that it exposes potential product vulnerabilities, including final solutions, to customers in a timely manner.

As a member of the FIRST and a CVE Numbering Authority (CNA), ZTE is dedicated to publishing vulnerability exposures jointly with customers and stakeholders in a more open manner. Relevant exposures can be found on CVE and ZTE website.

Click  Bulletin -Security Bulletins for more information.

ZTE is committed to continuously improving security of its products and services to provide users with secure and reliable service experience, so we have set up two bug bounty programs according to product categories.

We welcome security researchers/organizations to report security vulnerabilities in our products and services to us. We promise to follow up and respond to your reported security vulnerabilities as soon as possible.

ZTE has been cooperating with GSMA Coordinated Vulnerability Disclosure (CVD) programme to eliminate and mitigate vulnerabilities which are standards-related, for such vulnerabilities you may consider also submitting to GSMA CVD.

ZTE regularly publishes bug bounty bulletins and releases rankings.

Note：If you do not want to show your name, please inform us by email（psirt@zte.com.cn）, and we will replace it with "anonymity".