ASKEY Computer Corp. (the “Company”, “we”, or “us”) value the security of our products and services. We welcome reports from security researchers, customers and partners about potential security vulnerabilities affecting our products, and we handle them under coordinated vulnerability disclosure (CVD). This Policy has been developed with reference to coordinated vulnerability disclosure (CVD) principles and the relevant provisions of the EU Cyber Resilience Act (CRA), Regulation (EU) 2024/2847.

1. Scope
This reporting channel accepts reports of the following product security vulnerabilities:

• Security vulnerabilities affecting networking and communications products designed, developed or maintained by ASKEY (such as routers, modems, 5G and Wi-Fi devices), including but not limited to firmware, software and hardware design flaws.
• Vulnerabilities in third-party or open-source components integrated into such products. We will assess whether the relevant products are affected and coordinate with brand customers and upstream suppliers as needed.

Generally, out of scope:

• Issues generally outside the scope of this channel include physical-operation issues without a material security impact, purely volumetric attacks that do not involve a specific product vulnerability, and general product operation or after-sales service inquiries. ASKEY corporate IT systems, such as our website.

Customer-branded products: For products sold under a customer’s brand, we recommend that you also notify the brand owner. Upon receiving your report, we will coordinate handling and disclosure with the relevant brand owner.

2. How to report

• Email: security@askey.com (PGP encryption recommended)
• PGP key: [download link]

       fingerprint: 8558DA739C9FCCACE175DDF5BD7E8F65250A8843
       expiration date: 2028-10-29

• Languages: English, Traditional Chinese
• Anonymous reports are accepted. Please provide valid contact details if you wish to receive a response or be contacted.

3. Recommended Report Contents

• Product brand, name, model and version (including hardware and firmware versions)
• Vulnerability type, potential impact, reproduction steps, and any necessary proof of concept (POC), screenshots, or logs.
• Whether the vulnerability is known to have been actively exploited, together with relevant evidence or information sources.
• Whether the vulnerability has already been publicly disclosed or reported to other parties, such as the brand owner or a CERT, and any planned disclosure date.
• Contact details, if desired, please avoid submitting personal data or confidential information unrelated to validating the vulnerability.

4. How we handle reports
If you provide valid contact details, we will send you an acknowledgment of receipt and a message of thanks. An acknowledgement does not confirm that the vulnerability is valid, that a product is affected, or that the Company admits any legal liability.
Upon receiving a report, we will follow the process below:

1. Initial assessment: Assess the validity of the reported vulnerability, whether relevant products are affected, and its severity. .
2. Analysis and handling: If a product is confirmed to be affected, we will coordinate analysis and appropriate corrective or mitigating measures with our development teams, brand customers, or relevant suppliers, taking into account the nature of the vulnerability, the risks, and applicable support arrangements.
3. Coordination with brand customers: Provide necessary technical and handling information to assist brand customers in arranging the release of updates and disclosure of information.

Timelines depend on severity, technical circumstances, and the arrangements of the parties involved. We do not guarantee fixed assessment, remediation, or response deadlines, nor do we undertake to provide regular updates on individual reports. Where necessary, we will contact reporters to obtain additional information or coordinate disclosure. This Policy does not affect obligations arising under applicable law or contract.
For actively exploited vulnerabilities or severe incidents affecting product security, we will notify the relevant brand customers in a timely manner in accordance with applicable legal and contractual requirements. Furthermore, we will provide necessary information, assist with regulatory reporting or fulfill obligations legally applicable.

5. Coordinated disclosure
To protect users, please do not publish details before the brand owner releases a fix or advisory. If you plan to publish, please tell us the planned date in advance so we can coordinate with the brand owner and relevant parties.
Security updates and vulnerability advisories for customer-branded products are generally issued by the brand owner, with necessary assistance from us. However, where required by law or necessary to protect users’ security, we may provide relevant information in accordance with applicable law.
If you consent to public acknowledgement, we may help submit a request to the brand owner. Whether and how acknowledgement is published will be subject to the brand owner’s confirmation. We will not proactively disclose your name or other identifying information without your consent, except where disclosure is required by law.

6. Good faith research and Safe harbor
For research and reporting conducted within a lawfully authorized scope, in good faith and in compliance with this Policy, and without exceeding the scope of testing necessary, we will not take legal action against the reporter solely on the basis of such research and reporting activities.
This Policy does not authorize access to or testing of any equipment, systems, or data belonging to the Company, its brand customers, or other third parties, nor does it constitute a waiver of any third party’s rights.
Please observe the following principles when conducting research and testing:

• Test only equipment or environments for which you have lawful authorization, and only to the extent necessary to demonstrate the vulnerability.
• Do not engage in social engineering (such as phishing), volumetric denial-of-service attacks, or unnecessary disruption of normal service operations.
• Do not access, copy, modify, or delete others’ data without authorization, or use any access obtained for other purposes.
• If you inadvertently encounter personal data, confidential information, or other sensitive information, immediately stop the relevant activity and notify us. Do not collect or disseminate such information further.

7. Personal data
Information you provide is used only to handle the report and contact you. If the report concerns a customer-branded product or a third-party component, we may share the report and your name and email with the relevant brand owner or upstream supplier to coordinate remediation, and with authorities where required. If you prefer not to share your personal data, you may report anonymously. Otherwise, we will not share your information with third parties without your consent except as required by applicable law or a lawful request from a competent authority.

8. Other
This channel is not a bug bounty program. We do not offer monetary rewards or other compensation.
This policy explains our vulnerability reporting and coordination arrangements. It does not create a contract between Company and any reporter.
We may amend this Policy from time to time. Updated dates and version numbers will be published on this page. In the event of any inconsistency between the Chinese and English versions, the Chinese version shall prevail. 
Last updated: 2026-10-29　Version: 1.0