Oct 27, 2026  

Our commitment 

Comtrend welcomes reports of security vulnerabilities in our devices and services, and commits to acknowledging every report within 7 calendar days. This policy explains how to report a vulnerability, what you can expect from us, and how we publish fixes. 

We follow ISO/IEC 29147:2018 (vulnerability disclosure) and ISO/IEC 30111 (vulnerability handling). Reports are handled by the Comtrend Product Security Incident Response Team (PSIRT). 

Scope 

This policy covers all Comtrend products and services that currently receive security updates. 

In scope 

• Comtrend devices, including broadband gateways, routers, Wi-Fi extenders, ONTs and IoT products, and their firmware 
• Companion mobile apps, web management interfaces and cloud services operated by Comtrend 
• Open-source or third-party components as shipped inside Comtrend products 

Not eligible for security fixes 

• Products that have reached end of support 
• Pre-release, beta or test builds not offered for general sale 

• Firmware modified by a service provider or third party outside Comtrend’s control (we will help route these reports to the right party) 
• Websites and systems not related to Comtrend products, such as marketing sites 

If you are unsure whether something is in scope, report it anyway and we will tell you. 

How to report a vulnerability 

Send your report by e-mail to the Comtrend PSIRT at reportcv@comtrend.com. This mailbox is monitored by the PSIRT on business days. 

Please do not report vulnerabilities through social media or public forums, and do not include sensitive details in public bug trackers. If you contact Comtrend customer support by mistake, the report will be forwarded to the PSIRT. 

What to include in your report 

The more of the following you can give us, the faster we can confirm and fix the issue. Partial reports are still welcome. 

• Product name, model number and hardware revision 
• Firmware or software version, and app version and mobile OS if relevant 
• Description of the vulnerability and its type (a CWE ID is helpful) 
• Steps to reproduce, including device configuration and any connected devices 
• Proof-of-concept code, screenshots, packet captures or logs 
• Your estimate of impact and severity (a CVSS score is helpful) 
• Other vendors or products you believe are affected, and whether you have reported to them 
• Your disclosure plans, including any planned publication date 
• How you would like to be credited, or whether you prefer to stay anonymous 
• Your contact details 

What to expect from us 

We will keep you informed from the day we receive your report until a fix is released. 

Step	What happens	Our target
1. Acknowledgement	We confirm receipt and give you a tracking number	Within 7 calendar days
2. Initial assessment	We reproduce the issue and tell you whether we consider it a vulnerability, and why if not	Within 30 days
3. Investigation and fix	We find the root cause, check other affected products and develop and test a fix	Status update at least every 30 days
4. Release	We tell you the planned release date before we publish the fix and advisory	Before publication

We may contact you for more information during the investigation. If a fix is delayed, for example because a supplier or service provider must act first, we will explain the delay. Please use your tracking number in all messages about the report. 

Coordinated disclosure 

We ask that you keep vulnerability details confidential until we release a fix or 90 days have passed since your report, whichever comes first. We will agree a publication date with you and may ask for more time if a fix is complex or needs action by service providers. 

• If the vulnerability is being actively exploited, we may publish an advisory with interim mitigations before a fix is available, and will tell you first. 

• If the issue affects other vendors, for example a shared chipset SDK, open-source library or protocol, we will notify them directly or through a coordinator such as CERT/CC, and align publication dates. 

• If we disagree with you about timing, we will explain our reasons so that no one is surprised. 

We will request a CVE ID for each confirmed vulnerability. 

Security advisories and updates 

Comtrend distributes security advisories only through the Comtrend Technical Bulletin. To subscribe, visit https://lp.constantcontactpages.com/sl/Pv7k45u/technicalbulletin or contact sarah.tomasi@comtrend.com. Service providers and customers who deploy Comtrend devices are encouraged to subscribe. 

Each advisory includes: 

• A Comtrend advisory ID and the CVE ID of each vulnerability 

• The date of first publication and a revision history 

• Affected and fixed products and firmware versions, and how to check your version 

• A description, impact and severity rating (CVSS v3.1) 

• Remediation steps and any workarounds 

• Credit to the reporter, if they wish 

Advisories are sent only from comtrendconnection@comtrend.com. Firmware updates are digitally signed, and devices verify the signature before installing. Updates are delivered through the device’s automatic update feature, your service provider, or the Comtrend support site; always check the published SHA-256 hash for any firmware you download manually. 

Recognition 

With your permission, we will credit you by name or handle in the security advisory for the vulnerability you reported. Comtrend does not currently offer monetary rewards for vulnerability reports. 

Safe harbor 

Comtrend will not take legal action against you for security research that follows this policy in good faith. We consider such research authorized, and if a third party takes legal action against you for it, we will make it known that you acted under this policy. 

To stay within this policy: 

• Test only devices you own or are explicitly authorized to test 

• Do not access, change or delete data that is not yours, and stop as soon as you reach other people’s data 

• Do not degrade or disrupt Comtrend services, service provider networks or other users 

• Do not use social engineering, phishing or physical attacks against Comtrend staff or facilities 

• Give us reasonable time to fix the issue before disclosing it, as described above 

This policy cannot authorize testing of systems owned by service providers or other third parties. 

Other contacts 

Need	Contact
Product support or non-security bugs	NA.Support@Comtrend.com
Security incident affecting your own network	Your internet service provider first.
Press or media enquiries	sarah.tomasi@comtrend.com

Policy history 

Version	Date	Change
1.0	October 27, 2026	First published