Coordinated Vulnerability Disclosure Policy

MSI is dedicated to following the principles of Coordinated Vulnerability Disclosure (CVD) and actively collaborates with partners to address potential vulnerabilities. When a security issue is reported, MSI commits to allocating appropriate resources for analysis, validation, and the provision of corrective actions. Any information provided to MSI is used solely to assist in resolving the reported security vulnerability, which may include contacting you for further details. Once a vulnerability report is confirmed, MSI will notify the submitter as soon as possible and provide information on the processing status.

In compliance with Cyber Resilience Act (CRA) requirements for vulnerability handling, MSI encourages researchers and developers to report vulnerabilities. During the disclosure process, we request that reporters avoid harming user privacy, disrupting system operations, or damaging data. Furthermore, we ask that vulnerability information remain confidential until MSI has officially published a security advisory. You can report any potential security vulnerabilities in any MSI product so long as the following advisory principles are followed:

• During testing, avoid privacy violations, degrading user experience, disrupting systems, databases, or websites, or destroying data. In particular:
  • Do not cause potential or actual disruption or damage to MSI users, systems, databases, websites, services, or applications;
  • Do not exploit a vulnerability to view unauthorized data, or to otherwise corrupt or damage any data;
  • Do not perform social engineering attempts or otherwise misrepresent yourself, your affiliation, or authorization from MSI employees, contractors, or affiliates to access MSI assets;
  • Do not violate any laws or agreements in order to discover vulnerabilities.
• Report vulnerabilities findings promptly to MSI via official reporting channels listed in this advisory.
• Keep any discovered vulnerabilities information confidential until we have resolved the issue and a security bulletin is posted.
• If a vulnerability provides unintended or unauthorized access to data:
  • Limit the amount of data accessed to the minimal amount to demonstrate proof of concept;
  • Cease testing and submit a report immediately if you encounter any user data during testing, including Personally Identifiable Information (as defined under Regulation (EU) 2016/679 (General Data Protection Regulation) (“GDPR”), the California Consumer Privacy Act (“CCPA”), and equivalent applicable privacy laws and regulations), personal healthcare information, credit card data, or proprietary information.
• Only interact with test accounts you own or have explicit permission from the account holder to access and use such account.

MSI does not currently offer or participate in standing bug bounty programs. We do not honor requests for bounty payments, promotional material, or credit.

Reporting MSI Product Security Vulnerabilities

We welcome and encourage the reporting of any potential or confirmed vulnerabilities to the MSI CRA Product Security Incident Response Team (MSI CRA PSIRT). Reporting principles include:

• No Actual Harm: Reporters must not cause actual damage to MSI users, systems, or services.
• Data Integrity: Reporters must not exploit vulnerabilities to view unauthorized data or destroy any data.
• Privacy Protection: If user personal data (such as PII defined by GDPR) is involved, testing must cease immediately, and a report should be submitted.

Process for Reporting Security Vulnerabilities

Reporters should submit findings through official channels and include the following information:

• Your full name and a method of contact, including email, phone number, or another preferred method. For phone numbers, include the full country code, area code, and extension number (if applicable).
• The product type, product name, and product model number.
• The name, description, and version number of any affected MSI product or software.
• A full and detailed description of the issue, any background information that is relevant, and any other pertinent information that may help us reproduce and/or resolve the issue.

Full and detailed information about the reported vulnerability should be provided, as applicable.

Vulnerability Handling Timeline

MSI adheres to the following processing timelines for reports:

1. 1 Initial Acknowledgement — A tracking number will be provided within 3 business days of receiving the report.
2. 2 Vulnerability Confirmation — Notification of whether the vulnerability is accepted or rejected will be provided within 30 days of initial acknowledgement.
3. 3 Remediation — MSI strives to complete analysis and software remediation within 90 days. Please note that this timeline may be extended if it involves third-party vendors or hardware architecture changes.

Once the vulnerability is confirmed and accepted, MSI engineers will work to develop appropriate hardware and/or software remediation. MSI may contact you for additional information for confirmation purposes. MSI may close the case if you do not respond after 2 attempts and such information is critical to vulnerability remediation.

MSI endeavors to complete analysis and remediation work for software fix within 90 days of our initial acknowledgement. However, remediation release may need to be extended beyond 90 days due to factors that may be within and/or beyond our control, including:

• Upstream vendors having different issue resolution timeframes;
• Substantial hardware or architectural changes required to address vulnerability;
• Product life cycle resource limitations;
• Implementation and integration of remediation to products through multiple distribution chains or ecosystems operating on different resolution timeframes.

MSI may, at its sole discretion, periodically publish security bulletins updating the public on completed remediation work for the applicable MSI product(s).

Confidentiality and Transparency

Reporters are expected to keep information confidential until remediation is complete. MSI will, at its sole discretion and based on specific circumstances, determine whether to issue a security advisory to update the public on remediation progress. This transparency mechanism ensures that users receive the latest security guidance.

Latest Security Updates

MSI continuously releases security patches. Recent examples include:

Security Advisor Hall of Fame

We appreciate the security related disclosures done by the following people. Their fast reports made us quicker to fix the vulnerabilities of our products or websites, and we would like to thank you all and here the list of advisors to recognize their efforts. Your professionalism allows us to protect our users more effectively.

Disclaimer

This advisory and associated rights are governed by MSI’s official terms. MSI reserves the right of final interpretation and modification regarding vulnerability remediation plans, advisory content, and the Hall of Fame list.