Infomir Security Information

How to Report Security Issues

At Infomir, protecting our customers from security threats is of utmost importance. We are dedicated to ensuring that our products and services remain secure and stable while rigorously safeguarding the privacy and data of our users.

We encourage the prompt reporting of any product security or privacy concerns. We are committed to following established protocols to address these reports and provide timely feedback.

Guidelines for Responsible Reporting

1. All parties involved in a vulnerability disclosure must comply with the legal requirements of their respective countries or regions.
2. Reports should be based on the latest released firmware and should preferably be written in English.
3. Vulnerabilities should be reported through our designated communication channel via email at products.security@infomir.com. Infomir may also receive reports through other channels, but acknowledgment of these reports is not guaranteed.
4. Always adhere to data protection principles, ensuring that the privacy and security of Infomir’s users, employees, agents, services, or systems are not compromised during the vulnerability discovery process.
5. Maintain open communication and cooperation throughout the disclosure process, avoiding any disclosure of the vulnerability before the agreed-upon date.
6. Infomir currently does not offer a bounty program for vulnerability disclosures.

How Infomir Manages Vulnerabilities

Infomir proactively encourages customers, vendors, independent researchers, and security organizations to report any potential vulnerabilities. We also actively gather information from the community, vulnerability repositories, and security websites to stay informed about potential threats.

We aim to respond to vulnerability reports within 5 business days. Our security team will work with the product team to analyze and validate the report, assessing its validity, severity, and potential impact. We may contact the reporter for additional information if needed.

Upon identifying a vulnerability, we will develop and implement a remediation plan to address the issue for all affected customers.

While remediation generally takes up to 90 days, some cases may require more time. We will keep you informed of our progress and any remediation activities.

A security advisory will be issued under the following conditions:

1. The vulnerability is classified as CRITICAL by the Infomir security team, and sufficient mitigation solutions are available to address all associated risks.
2. The vulnerability has been actively exploited, or there is a significant risk to Infomir customers, which could lead to public concern about the security of our products. In such cases, Infomir will expedite the release of a security bulletin, which may include a full firmware update or an emergency fix.

Information on Minimum Security Update Periods

Infomir maintains active support for its components with security updates from September 2024 to January 2027.

This list is constantly being updated and may change without notice.

Android Security Patch Updates: These updates depend on Google's policies. If an Android security patch is no longer updated within 3 years, the associated product will no longer receive updates for that patch. Other updates will continue according to our policy.