In u-blox, the safety and security of our customers and users has always been a top priority. We are dedicated to improving our products continuously, focusing on changing market needs, technologic breakthrough, as well as evolving threat surface and new attack vectors. This Responsible Disclosure Policy is in place to identify new vulnerabilities and security issues in the relevant hardware, software or services provided by u-blox (“u-blox Products”) and to address them in a timely manner.
You can use this platform to report a vulnerability/security issue in any u‑blox Product, excluding end-of-life u‑blox products/services. In addition, u-blox is running an in-invite only bug-bounty program for certain u-blox services, that is operated in partnership with BugCrowd, for which you can apply (u-blox Bug Bounty Program on Bugcrowd).
Reporting a vulnerability in a good faith and by academical/private research is possible through our Responsible Disclosure Policy and is not going to be penalized. Targeted, malicious or persistent attacks, however, are strictly forbidden and will be reported to the relevant authorities in accordance with the relevant laws.
How to report
If you are an existing u-blox customer, you can submit a vulnerability/security issue report creating a support ticket in u-blox support portal.
In case you participate in the bug bounty program, please report your findings through Bugcrowd platform. In other cases, please contact us at firstname.lastname@example.org.
When reporting a security issue through email, do not send us any issue information in the initial message. Instead, send us the following information:
PGP public key and fingerprint: 359F 2E00 85CF 57DF 45B5 3970 B106 63C8 757F 1A21
After we have established the secure communication, please send us the following information to be able to address the issue:
u-blox will assess each submission received. After your message, the following actions will be undertaken:
To prevent exploitation of reported vulnerabilities/security issues before workarounds or fixes are available, we kindly ask you to refrain from disclosing the vulnerability/security issue until u-blox allows you to do so.
To recognize your contributions aside from payouts through the invite-only bug bounty program, we may, upon your authorization, thank you through an entry in the Acknowledgements section below. Please also note that as to your contribution made the terms and conditions for the u-blox website apply, and u-blox will thus be able to use any information provided in any commercial context.
We would like to thank all individuals and companies who have reported security issues in u-blox infrastructure or Products.
|Ronak Nahar||Aishwarya Kendle||Ali Razzaq||Mohammed Adam|
|Usama Abid||Avi Chakravarti||Badal Sardhara||Merbin Russel|
We continuously monitor and investigate reported security issues. In this section, we publish confirmed security vulnerabilities related to u-blox Products.
Frame Aggregation vulnerability (FRAG)
Please refer to the information note. A new firmware is now available for a some of the affected products. u-blox teams are working on the further releases.
|Spectra coexistence vulnerability||
|Please refer to the information note. A new firmware is now available that patches the issue.|
|CVE-2019-16336, CVE-2019-17519, CVE-2019-17517, CVE-2019-17518, CVE-2019-17520, CVE-2019-19195, CVE-2019-19196, CVE-2019-17061, CVE-2019-17060, CVE-2019-19192, CVE-2019-19193, CVE-2019-19194 (Sweyntooth)||
Please refer to the information note. A new firmware is now available that patches the issue.
Fault injection vulnerability in nRF52 chips
|Please refer to the design considerations and product recommendations in the information note.|
|CVE-2019-15126 (Kr00k)||JODY-W1 series||Please refer to the information note. A new firmware is now available that patches the issue.|