IoT Vulnerability Report

Report a security issue in Ferqo products and services. Our security team reviews all submissions under the Vulnerability Disclosure Program.

Response Commitment & Scope

In Scope

MG-1 Matter Gateway (firmware)
Ferqo App (iOS / Android)
Ferqo Cloud Services (API & infrastructure)

Timeline

Acknowledgement within 3 business days
Confirmed within 5 business days

Severity	CVSS	App / Cloud	Firmware OTA
Critical	9.0–10.0	12 hours	7 days
High	7.0–8.9	24 hours	14 days
Medium	4.0–6.9	48 hours	60 days
Low	0.1–3.9	96 hours	90 days

Part 1 — Reporter Information

Full Name

Email Address

Organization

Preferred Contact Method

PGP Public Key

Part 2 — Vulnerability Details

Product / Service Affected

Version

Vulnerability Type

Description

Steps to Reproduce

Impact Assessment

Proof of Concept (PoC)

CVSS v3.1 Score / Vector

Optional. Use the CVSS Calculator if needed.

Attachments

Part 3 — Disclosure Policy & Legal

Disclosure Preference

Coordinated Disclosure (Preferred) — details published after patch is released Full Public Disclosure — publish after agreed timeline Private Disclosure — keep confidential

Safe Harbor
FLH Co., Ltd. will not pursue legal action against researchers who conduct security research in good faith, provided that:
(1) Research does not harm users, systems, or data;
(2) The vulnerability is reported via this form before any public disclosure;
(3) Researcher follows the disclosure timeline agreed upon with FLH.

FLH commits to: acknowledging all valid reports within 3 business days, providing progress updates throughout remediation, and notifying the reporter once a patch is released.

I confirm that I have read and agree to the Safe Harbor Policy stated above. I will conduct security research in good faith and will not cause harm to users, systems, or data.