Coordinated Vulnerability Disclosure

To provide a channel for the public (e.g., security researchers, customers) to report vulnerabilities to LK, and to reduce the likelihood of irresponsible disclosure (e.g., security researchers reporting directly to the media). Providing a legitimate vulnerability disclosure channel is a critical link between LK and the cybersecurity community.

To report a vulnerability in an LK product, please send an email to bick@lkong.com.cn and encrypt your report using the following GPG key before sending. We strongly encourage you to send us the vulnerability for remediation before publicly disclosing it, so that we can properly address any issues.

When reporting a vulnerability, we require the following information:

• Please submit your report in English.

• Please provide specific information about the affected product, including model or serial number, geographic location, software version, and how the product was obtained.

• If you have developed proof-of-concept code that exploits the vulnerability, please provide the code and instructions for exploitation.

• If you are aware of any incidents where field devices have been exploited using this vulnerability (e.g., an LK customer is directly affected by the vulnerability).

• Information you provide about how the vulnerability was discovered, your views on its impact or CVSS scoring, and potential remediation solutions will help us triage the vulnerability more quickly.

• Please provide information about yourself or the company/organization you represent, or indicate if you wish to remain anonymous.

• If you have a preferred method of contact during our internal triage process, please let us know.

• Please indicate whether you intend to disclose this vulnerability to us or to the public.

In response, you can expect the following from us:

• We will acknowledge receipt of your report within one business day.

• During the initial assessment of the vulnerability, the LK cybersecurity team may contact you to do one of the following:

  • Request additional information to supplement your initial report.

  • Communicate our expected triage process and timeline.

  • Inform you that the report is out of scope or will not be triaged for other reasons.

• After completing our own vulnerability assessment, we will publish our assessment process and findings.

• If requested by a reporter and that request results in public disclosure, we will list the reporter's name in the final report.