EZVIZ Bug Bounty Program

About

Established in 2013, EZVIZ dedicates itself to create a safe, convenient and smart life for worldwide users through our IoT Products, advanced technologies and cloud services.

Program Rules

Thank you for your interest in EZVIZ bug bounty program.

• We believe that no technology is perfect and that working with skilled security researchers is crucial in identifying weaknesses in our Products or Services.

• If you believe you've found a security bug relating to us, we are happy to work with you to resolve the issue promptly and ensure you are fairly rewarded for your discovery

Reward Eligibility and Responsible Disclosure

We are happy to thank everyone who submits valid reports which help us improve the security of EZVIZ, however only those that meet the following eligibility requirements may receive a monetary reward:

• You must be the first reporter of a vulnerability.

• The vulnerability must be a qualifying vulnerability (see below).

• "OneFixOneReward": If two or more endpoints use the same codebase and a single fix can be deployed to fix all the different endpoints, only one endpoint will be considered as eligible for a reward and other reports will be closed as Informative. Regardless, such reports will be reviewed on a case by case basis.

• You must send a clear textual description of the report along with steps to reproduce the issue, include attachments such as screenshots or proof of concept code as necessary.

• You must avoid tests that could cause degradation or interruption of our service systems (refrain from using automated tools, and limit yourself about requests per second).

• You must not leak, manipulate, or destroy any user data.

• You must not be a former or current employee of EZVIZ or one of its contractors.

• Our analysis is always based on worst case exploitation of the vulnerability, as is the reward we pay.

• No vulnerability disclosure, including partial is allowed.

Vulnerability Classification

Critical Vulnerabilities

• Vulnerabilities that directly obtain core system permissions. Including but not limited to:

(Able to obtain any user's real-time camera video and playback; able to obtain full database permissions of core applications; obtaining system permissions through command injection, remote command execution, uploading to obtain WebShell, SQL injection to obtain system permissions, buffer overflow (including exploitable ActiveX buffer overflow), remote kernel code execution vulnerabilities, and other remote code execution vulnerabilities caused by logic issues (based on the permissions actually obtained).)

• Severe information leakage. Including but not limited to SQL injection vulnerabilities in core databases; leakage of three or more sensitive information fields, and the affected amount reaching a certain scale (greater than or equal to 100,000 records); if not met, the score will be adjusted according to the actual situation.

(Sensitive information fields refer to personal real name, ID number, address, contact information, bank card number, complete transaction information, etc.)

• Severe logical design flaws. Including but not limited to arbitrary account login for core domain products, arbitrary account password modification (non–brute-force vulnerabilities caused by other business logic issues), arbitrary account fund consumption, transaction and payment issues (for mainstream hardware products such as cameras/door locks/robot vacuums, and for value-added services such as cloud storage that can affect core product transaction pricing; relatively niche value-added services may be downgraded after evaluating actual business impact), and other severe logical vulnerabilities.

High-Risk Vulnerabilities

• Vulnerabilities that directly obtain general system permissions. Including but not limited to: command injection, remote command execution, uploading to obtain WebShell, SQL injection to obtain system permissions, buffer overflow (including exploitable ActiveX buffer overflow), remote kernel code execution vulnerabilities, and other remote code execution vulnerabilities caused by logic issues (based on the permissions actually obtained).

• Sensitive information leakage. Including but not limited to SQL injection vulnerabilities in non-core databases; leakage of three or more sensitive information fields, with affected quantity reaching a certain scale (greater than or equal to 10,000 records); if not met, the score will be adjusted according to the actual situation.

(Sensitive information fields refer to personal real name, ID number, address, contact information, bank card number, complete transaction information, etc.)

• SSRF vulnerabilities that can directly access the Ezviz internal network with full response, and can access core business network segments; if not, severity may be lowered.

• Privilege escalation vulnerabilities. Including but not limited to unauthorized modification of important information, bypassing authentication to directly access admin backend, important business configuration changes, and other significant unauthorized operations (based on actual business scenarios).

Medium-Risk Vulnerabilities

• Vulnerabilities that can directly steal user identity information. Including stored XSS on critical pages, SQL injection on ordinary sites.

• Unauthorized access. Including but not limited to unauthorized bypass of restrictions to modify user information, perform user actions, backend weak passwords, etc. (based on actual business scenarios).

• Common information leakage. Including but not limited to leakage of internal source code packages, cloud platform key leakage, vulnerabilities that can be proven exploitable and can cause certain damage or leak a certain amount of personal sensitive information (scored based on actual situation).

• Exploitable communication protocol vulnerabilities and business logic vulnerabilities with certain impact.

Low-Risk Vulnerabilities

• Vulnerabilities that require interaction to obtain user identity information. Including but not limited to reflected XSS (including reflected DOM-XSS), CSRF for important sensitive operations, stored XSS in ordinary business.

• Common logical design flaws. Including but not limited to SMS verification bypass, email verification bypass, brute-forcing SMS codes, SMS bombing, etc.

• Minor information leakage vulnerabilities. Including but not limited to internal system source code leaked on GitHub, phpinfo, correct internal network account credentials, etc.

• Minor unauthorized access. Including but not limited to unauthorized operations on non-critical core functional interfaces (based on actual business scenarios).

No Impact

• Non-security-related bugs. Including but not limited to garbled webpages, product feature defects, layout issues.

• "Vulnerabilities" that cannot be exploited. Including but not limited to meaningless scanner-reported vulnerabilities (e.g., low-version web server), self-XSS, JSON hijacking without sensitive information, CSRF without sensitive operations, meaningless source code leakage, internal IP addresses/domain name leakage, logcat leakage without sensitive data.

• Vulnerabilities with extremely low risk or difficult to exploit. Including but not limited to PDF XSS, URL redirection, email bombing, SSRF that cannot reach internal networks, SSRF without response, username enumeration, concurrent requests modifying unimportant data in certain products (e.g., view count, number of signups, non-important like/score features), meaningless API key leakage, command execution vulnerabilities that only provide dnslog results.

• Other issues that cannot directly demonstrate a vulnerability. Including but not limited to purely user speculation.

• Vulnerabilities that cannot be reproduced. Including but not limited to issues confirmed as non-reproducible by YSRC specialists.

• Vulnerabilities already known through other channels that will be ignored, and the reporter will be notified through the submission system.

• Non–Ezviz business vulnerabilities, vulnerabilities not related to Ezviz product defects, and security issues not directly caused by Ezviz products.

• Vulnerabilities from test environments, pre-release environments, or private cloud demo environments (e.g., domain names starting with t, test, pb, etc.), unless there is evidence that the vulnerability also affects the production environment.

• Local denial-of-service vulnerabilities in mobile clients. Including but not limited to local DoS caused by component permissions.

Testing Policy

Please test vulnerabilities only against your own accounts. Only use authorized accounts so as not to inadvertently compromise the security or privacy of our users.

• Avoid tests that could cause degradation or interruption of our service systems.

• Do not use automated scanners or tools that generate large amount of network traffic.

• Do not leak, manipulate, or destroy any user data or files in any system.

• Do not copy any files from the system or disclose them.

Reward Structure

Scopes

Out of Scope

• Test environment (for example: test.ys7.com)
• Pre-release environment (for example: pb.ys7.com)
• Demo environment (for example: ezcpcloudiot.eziot.com)

Hunters Collaboration

When submitting new report, you can add up to 5 collaborators, and define the reward split ratio.

For more information, see the help center. Note: For reports that have already been rewarded, it is not possible to redistribute the rewards.