Hexing PSIRT

Vulnerability Reporting Channels
If you discover suspected security vulnerabilities in Hexing products, you are welcome to submit reports promptly via email: psirt@hxgroup.com
We will respond to all vulnerability submissions promptly. In most cases, you will receive an acknowledgement email within 48 hours. We will notify you of relevant updates throughout the vulnerability remediation lifecycle.
To streamline vulnerability handling, please provide vulnerability details following the template requirements.

Security Mechanism
To protect the confidentiality of vulnerability information, we recommend you encrypt all submissions using PGP (Pretty Good Privacy).
Hexing PGP public key (Key ID 0x4BCC88B9; PGP fingerprint: 70C5 F1C4 6F2D 1B07 58BF F889 3523 DD3E 4BCC 88B9). Click here to download.
Throughout the vulnerability handling process, the Hexing PSIRT team will strictly limit access to vulnerability information to relevant personnel only. We request that you maintain confidentiality of the vulnerability details prior to official public disclosure by Hexing.

Scope of Response
Products within active service coverage (excluding end-of-service and end-of-support products).

Coordinated Vulnerability Disclosure Policy
Click to view Hexing Coordinated Vulnerability Disclosure Policy.

Vulnerability Handling Process
Hexing attaches importance to vulnerability management throughout the full product lifecycle. We have established a complete vulnerability handling process in line with industry standards to ensure effective and timely resolution of security vulnerabilities. The vulnerability handling process consists of five phases:

1. Vulnerability Receipt：
Hexing encourages security researchers, industry organizations, customers and suppliers to actively submit suspected product security vulnerabilities. Meanwhile, Haixing PSIRT will proactively collect industry threat intelligence and identify valid vulnerability information.

2. Validation & Assessment：
The Hexing PSIRT team analyzes and verifies suspected vulnerabilities. We grade and score product security vulnerabilities in accordance with the CVSS standard to finalize assessment results.

3. Vulnerability Remediation：
For confirmed valid vulnerabilities, Hexing PSIRT collaborates with product teams to formulate, develop and deliver remediation solutions (including mitigations and fixes) to address security risks and safeguard the security and stability of customer data and systems.

4. Vulnerability Publication：
Throughout the vulnerability lifecycle, Hexing PSIRT maintains communication with customers and relevant stakeholders, shares handling progress, assists customers in implementing fixes at the earliest opportunity, and completes coordinated vulnerability disclosure.

5.Closed-Loop Improvement：
Adhering to continuous improvement principles, Hexing will keep enhancing product security and optimizing the vulnerability handling process.

Vulnerability Disclosure Policy
Hexing discloses vulnerability information and corresponding remediation solutions in the following three forms:
Security Advisory：Security Advisory contains vulnerability severity level, affected products and version ranges, business impacts and remediation solutions. It is generally used to disclose information and fixes for critical and high-risk vulnerabilities in Hexing products, enabling customers to understand vulnerabilities and assess risks. Hexing reserves the right to publish and continuously update security advisories.
Security Statement：Security Statement includes vulnerability descriptions, summaries of security topics, and latest handling progress. It is used for disclosing widely discussed security topics (including vulnerability and non-vulnerability related matters), allowing relevant parties to track progress in a timely manner.
Release Notes：Release Notes document information on resolved vulnerabilities. They are used to disclose fixed security vulnerabilities to help customers understand the security status of products.

Appendix

note：The personal data (such as email addresses and names) contained in the vulnerability report you submitted will only be used for vulnerability investigation and repair. The processing is based on your consent and our legitimate interests. Your identity will be strictly confidential and will not be disclosed to any third party without your explicit consent. For detailed data processing rules, please refer to our [Privacy Policy] (please provide the link path here). You have the right to withdraw your consent at any time or exercise your data subject rights, but this may be restricted during the vulnerability investigation period.