At GN Hearing, we take security and privacy seriously and we commit to doing our best to secure our products and maintain our customers' trust. As part of this commitment, GN Hearing supports its products with security updates and, where appropriate, mitigations for vulnerabilities that may affect the confidentiality, integrity, or availability of our products, throughout the support period for each product.
Introduction
GN Hearing is committed to the security and assurance of all our products and services.
We recognize the important role that independent security researchers and other members of the security community play in helping to protect our systems and data..
To support this, GN Hearing welcomes vulnerability reports about our products so that our teams can collaborate with reporters to investigate the issue and, where appropriate, coordinate a security fix. This policy defines GN Hearing’s Vulnerability Disclosure Program for security vulnerabilities in GN Hearing products and services.
As part of this is described how to report vulnerabilities in a responsible way.
Scope
The Product Vulnerability Disclosure Policy addresses all products and services, including software and hardware, sold under GN Hearing.
We welcome reports about security vulnerabilities that impact confidentiality, integrity, or availability of GN Hearing products and services, including unauthorized access, privilege escalation, code execution, or data exposure issues, provided they are not listed as out of scope below:
Suggestion on configuration management and/or misconfigurations based on best practices.
Weak TLS/SSL configuration and certificates, including insecure cipher suites.
UI/UX bugs.
Our product vulnerability policy is designed to address vulnerabilities within our own products. Any vulnerabilities related to third-party vendors fall outside of this policy and should be reported directly to the vendor according to their disclosure policy (if any).
If acting in good faith when reporting vulnerabilities under this policy, GN Hearing will not pursue civil action or support any legal action related to your security research activity for accidental, good faith violations of this policy, or initiate a complaint to law enforcement for unintentional violations.
We encourage you to contact us - using the contact information below - for clarification before engaging in conduct that may be inconsistent with or unaddressed by the policy.
When trying to exploit a potential vulnerability, you must always consider the following conditions:
If you have discovered a security vulnerability affecting a GN Hearing product or service, please submit a vulnerability report using form.
Provide the following information:
A detailed description of the suspected vulnerability, including the type of issue, product and version affected, date of discovery, and any potential configuration applied to the product.
Step-by-step instructions required to reproduce the vulnerability. If possible, provide screenshots or any other media that supports the process.
Any additional information that might be of help when assessing the vulnerability.
If Personal Identifiable Information (PII) or any other confidential information is disclosed, report it to us while complying with applicable laws, i.e. limit your access to PII and any other confidential information and refrain from storing, saving, or transferring the data.
Upon receipt, GN Hearing will acknowledge the report, and we will investigate it and work out a fix to the vulnerability if validated. In this regard, an open confidential dialogue will be encouraged, and we might request additional information from you to help with the resolution.
Acknowledge receipt of your report within 3 business days.
Assess the report to determine whether we can reproduce the issue, whether it is in scope, and its potential severity. For reports that contain sufficient detail, we aim to provide an assessment within 2 weeks of acknowledgement.
Communicate the outcome of our assessment to you and request any additional information if needed.
Different product models may have unique architecture, firmware versions, and underlying technologies. Consequently, the development and testing of security patches can vary.
We commit to addressing vulnerabilities across all affected models but acknowledge that delivery times may differ. Security patches might require patch input from third party vendors that might influence overall timeline of mitigating vulnerabilities.
Keep in mind that our customers' security is a priority and therefore we need to give them enough time to apply any fix that has been developed to remediate the vulnerability. In that regard, we request you not to disclose publicly any information about the vulnerability until the whole process has been completed, including the release of the fix, public disclosure of the vulnerability, and notification to our users and customers (if required).
Whenever applicable, GN Hearing will coordinate with you on a public disclosure of the vulnerability. Be informed that GN Hearing currently doesn't offer any monetary compensation nor bug bounty program for discovered vulnerabilities but an acknowledgment to the reporting person can be posted together with the security disclosure from GN Hearing.