Overview of Policies

At EPH Controls, we prioritize addressing security concerns swiftly and effectively. Upon receiving a report of a potential issue, we dedicate the necessary resources to thoroughly analyse, validate, and implement corrective measures.

Our objective is to reduce the risk our customers face due to security vulnerabilities by offering prompt updates, guidance, and solutions for our products. This commitment extends to our software, applications, hardware, devices, services, and solutions. Our technical team is responsible for receiving, investigating, coordinating internally, resolving, and disclosing security vulnerability information pertinent to EPH Controls products

Security Update Support Process

To ensure our customers remain protected, EPH Controls commits to providing security update support for a minimum of 3 years for all our IoT products. If you identify a security or privacy vulnerability affecting EPH Controls equipment, software, services, or web servers, we encourage you to report it. We welcome input from security researchers, developers, and customers.

Our technical team will quickly and carefully address any reported security vulnerabilities in our products. We prioritize the safety and security of our customers by implementing timely security updates and ensuring continuous protection against potential threats.

To report any security issues, please contact our security team at security@ephcontrols.com.

Response Time

EPH Controls will verify the report within 3 working days of receipt and conduct an initial assessment. This assessment will be completed within 7 working days, after which the vulnerability will either be patched or a remediation plan will be developed.

Resolution Time

Critical risk vulnerabilities will be patched within 7 working days of the assessment.

High & medium risk vulnerabilities will be addressed within 30 working days.

Low-risk vulnerabilities will be resolved within 180 working days.

Resolution times may vary based on environmental or hardware factors, and adjustments may be made according to the specific circumstances. Throughout the remediation process, EPH Controls will maintain ongoing communication with the reporter until the issue is resolved.

Vulnerability Risk Classification

Non-Vulnerabilities:

The issues are not considered vulnerabilities

1. Non-Security Bugs: Issues such as product functional defects, garbled web pages, design inconsistencies, static file directory traversal, and compatibility problems.
2. Non-Exploitative Vulnerabilities: Issues that cannot be exploited, including CSRF without sensitive operations, inconsequential information leakage, and leakage of internal IP addresses or domain names.
3. Non-Indicative Problems: Issues that do not clearly indicate the presence of vulnerabilities, such as speculative or unfounded concerns.

Low-Risk Vulnerabilities:

1. Limited Impact Vulnerabilities: Vulnerabilities that may impact the system but do not compromise device permissions or data security. Examples include minor information disclosures, URL redirections, low-risk XSS vulnerabilities, and common CSRF vulnerabilities.
2. Ordinary Unauthorized Operations: Issues involving unauthorized actions, such as incorrect direct object references.
3. Common Logic Design Flaws: Issues like bypassing SMS or email verification mechanisms.

Medium-Risk Vulnerabilities:

1. User Identity Exposure: Vulnerabilities that can reveal user identity information, such as stored XSS vulnerabilities.
2. Arbitrary Text Operations: Vulnerabilities allowing file operations such as reading, writing, deleting, or downloading.
3. Unauthorized Access: Issues enabling unauthorized modifications to user data or actions bypassing restrictions.

High-Risk Vulnerabilities:

1. Business Server Access: Vulnerabilities that allow unauthorized access to business server functions, including arbitrary command execution, web shell uploads, arbitrary code execution, command injection, and remote command execution.
2. Severe Logical Flaws: Critical logical errors with serious impacts, such as vulnerabilities allowing unauthorized changes to account passwords.
3. Batch Identity Theft: Vulnerabilities that enable bulk theft of user identity information, including SQL injection.
4. Critical Unauthorized Access: Issues such as bypassing authentication to access admin backends or weak backend passwords.

Critical Risk Vulnerabilities:

1. Core System Access: Vulnerabilities providing direct access to core system permissions or endangering the internal network, including command execution and remote overflow.
2. Massive Data Exposure: Vulnerabilities that compromise substantial amounts of core user data.
3. Severe Logical Flaws: Critical logical errors that can cause significant harm or losses to companies and users, including serious exploitative vulnerabilities.