FOSCAM Security Information

Information On How to Report Security Issues

Protecting customers from threats to their security is a primary task for FOSCAM. As a key player in global Networking and Smart Home markets, FOSCAM strives to provide users with secure, stable products and services, and to strictly protect the privacy and security of user data.

FOSCAM welcomes and encourages all reports related to product security or user privacy. Established processes are followed to address these reports and provide timely feedback.

Report Vulnerabilities to FOSCAM

FOSCAM strongly encourages organizations and individuals to contact FOSCAM's security team to report any potential security issue. To report a security or privacy vulnerability, please send an email to support@foscam.com with the product model and software version. Describe the detailed security issue. FOSCAM will endeavor to respond to the report within 6 working days.

FOSCAM requires detailed information about the reported vulnerability to more accurately and quickly begin the verification process.

Responsible Reporting Guidelines

1. All parties to a vulnerability disclosure should comply with the laws of their country or region.
2. Vulnerability reports should be based on the latest released firmware and preferably written in English.
3. Report vulnerabilities through the dedicated communication channel. FOSCAM may receive reports from other channels but does not guarantee that the report will be acknowledged.
4. Adhere to data protection principles at all times and do not violate the privacy and data security of FOSCAM's users, employees, agents, services, or systems during the vulnerability discovery process.
5. Maintain communication and cooperation during the disclosure process and avoid disclosing information about the vulnerability prior to the negotiated disclosure date.
6. FOSCAM is not currently operating a vulnerability bounty program.

How FOSCAM Deals with Vulnerabilities

FOSCAM encourages customers, vendors, independent researchers, and security organizations to proactively report any potential vulnerabilities to the security team. FOSCAM also proactively obtains information about vulnerabilities in FOSCAM products from the community, vulnerability repositories, and various security websites to stay aware of vulnerabilities as soon as they are discovered.

FOSCAM will respond to vulnerability reports as soon as possible, typically within a few business days. FOSCAM Security will work with the product team to perform a preliminary analysis and validation of the report to determine the validity, severity, and impact of the vulnerability. FOSCAM may contact the reporter if more information is needed.

Once a vulnerability has been identified, FOSCAM will develop and implement a remediation plan to provide a solution for all affected customers. Remediation typically takes up to 90 days and may take longer in some cases. Customers can keep up to date with progress and the completion of remediation activities.

FOSCAM will issue a security advisory when one or more of the following conditions are met:

1. The severity of the vulnerability is rated CRITICAL by the FOSCAM security team, and FOSCAM has completed the vulnerability response process with sufficient mitigation solutions available to assist customers in eliminating all security risks.
2. The vulnerability has been actively exploited and is likely to increase the security risk to FOSCAM customers, or the vulnerability is likely to increase public concern about the security of FOSCAM products. In such cases, FOSCAM will expedite the release of a security bulletin about the vulnerability, which may or may not include a full firmware patch or emergency fix.

[Diagram: A flowchart illustrating the vulnerability management process: Awareness & Receipt -> Verification -> Remediation -> Notification.]

Information on Minimum Security Update Periods

The support period for FOSCAM components is actively maintained, considering security updates from January 2022 to January 2025. This list is subject to change without notice.