Information On How to Report Security Issues

Protecting our customers from threats to their security is always an    important task for AQUAGEM. As a key player in global Networking and Smart    Home markets, we will do our utmost to provide our users with secure stable    products and services, and to strictly protect the privacy and security of    their data. We welcome and encourage all reports related to product security    or user privacy. We will follow established processes to address them and    provide timely feedback.

Report Vulnerabilities to AQUAGEM

We strongly encourage organizations and individuals to contact AQUAGEM’s    security team to report any potential security issue. To report a security    or privacy vulnerability, please send an email to     security@aquagem.com with the product model and software version, describe the detailed security    issue to us. AQUAGEM will endeavor to respond to the report within 5 working    days. AQUAGEM will need to obtain detailed information about the reported    vulnerability to more accurately and quickly begin the verification    process.

Responsible Reporting Guidelines

1. All parties to a vulnerability disclosure should comply with the laws of    their country or region.

2. Vulnerability reports should be based on the latest released firmware, and    preferably written in English.

3. Report vulnerabilities through the dedicated communication channel.

4. AQUAGEM may receive reports from other channels but does not guarantee that    the report will be acknowledged.

5. Adhere to data protection principles at all times and do not violate the    privacy and data security of AQUAGEM’s users, employees, agents, services or    systems during the vulnerability discovery process.

6. Maintain communication and cooperation during the disclosure process and    avoid disclosing information about the vulnerability prior to the negotiated    disclosure date.

7. AQUAGEM is not currently operating a vulnerability bounty program.

How AQUAGEM Deals with Vulnerabilities  

AQUAGEM encourages customers, vendors, independent researchers, security    organizations, etc. to proactively report any potential vulnerabilities to    the security team. At the same time, AQUAGEM will proactively obtain    information about vulnerabilities in AQUAGEM products from the community,    vulnerability repositories and various security websites. In order to be    aware of vulnerabilities as soon as they are discovered.

AQUAGEM will respond to vulnerability reports as soon as possible, usually    within 5 business days.

AQUAGEM security will work with the product team to perform a preliminary    analysis and validation of the report to determine the validity, severity,    and impact of the vulnerability. We may contact you if we need more    information about the reported vulnerability.

Once the vulnerability has been identified, we will develop and implement a    remediation plan to provide a solution for all affected customers.

Remediation typically takes up to 90 days and in some cases may take    longer.

You can keep up to date with our progress and the completion of any    remediation activities.

AQUAGEM will issue a security advisory when one or more of the following    conditions are met:

1. The severity of the vulnerability is rated CRITICAL by the AQUAGEM security    team and AQUAGEM has completed the vulnerability response process and    sufficient mitigation solutions are available to assist customers in    eliminating all security risks.

2. If the vulnerability has been actively exploited and is likely to increase    the security risk to AQUAGEM customers, or if the vulnerability is likely to    increase public concern about the security of AQUAGEM products, AQUAGEM will    expedite the release of a security bulletin about the vulnerability, which    may or may not include a full firmware patch or emergency fix. Awareness    & Receipt Verification Remediation Notification

Information on Minimum Security Update Periods

The Support Period for AQUAGEM components is actively maintained considering security updates from November 2025 to November 2028.

* This list is constantly being updated and subject to change without notice.