Reporting vulnerabilities

MiWire welcomes reports of security vulnerabilities in the RouDem, its firmware and the MiWire services it communicates with. This page is MiWire’s coordinated vulnerability disclosure policy. The same information is published in machine-readable form at /.well-known/security.txt (RFC 9116).

Pending decision

The contact address, the response targets and the scope below are a draft. The address security@miwire.net is a placeholder until the mailbox has been confirmed; until then, report security issues through your usual MiWire support contact and mark the message as a security report.

How to report

Send an e-mail to security@miwire.net (placeholder, pending).

Please include, as far as you can:

• the product and firmware version (shown on the status page of the web interface, see Identification), or the MiWire service and URL concerned,
• a description of the issue and its impact,
• the steps needed to reproduce it, with any proof-of-concept material,
• whether the issue is already public or known to others,
• how you would like to be credited, if at all, and how MiWire can reach you.

Encrypting your report is optional. A PGP key for the security address will be published here when the mailbox is set up (pending).

Please do not report security issues through public issue trackers or social media.

What MiWire does with a report

Step	Target
Acknowledge receipt	pending: within N working days
First assessment and expected timeline	pending
Fix or mitigation for a confirmed vulnerability in the supported firmware	as soon as practicable; shipped through the automatic update
Advisory published on Advisories	when the fix is available to all units

MiWire will keep you informed of progress and will tell you when a fix has been released. Where a vulnerability affects a third-party component, MiWire coordinates with the component’s maintainers.

Coordinated disclosure

MiWire asks reporters to give it a reasonable time to fix the issue before making details public, and in return commits to:

• act on reports in good faith and not take legal action against researchers who follow this policy, test only against their own units or MiWire’s test services, do not access or alter other customers’ data, and do not disrupt the service,
• credit the reporter in the advisory if they wish,
• publish an advisory for every confirmed vulnerability that affected shipped firmware.

Scope

In scope: RouDem firmware and hardware, the unit’s web interface, and the MiWire services the unit communicates with (listed on Communications).

Out of scope: the mobile network operators’ networks and SIM services; the cellular module’s own firmware, unless the issue is reachable through the RouDem; denial of service by traffic volume; findings that require physical access to an opened unit; reports generated by automated scanners without a demonstrated impact.