Home / Advisory
Redfox Cyber Security Inc. (referred to as Redfox Security in this policy) frequently uncovers critical security flaws or vulnerabilities in third-party code and systems, including vendor and open-source software. We advocate for responsible action from vendors and security researchers regarding vulnerability disclosure, aiming for prompt resolution and community awareness through patches and system updates. Redfox Security adopts an approach aligned with Google Project Zero’s policy, setting a 90-day disclosure deadline.
Once we detect security vulnerabilities in third-party or open-source products, we provide a technical report to both vendors and open-source projects involved. The method of disclosure depends on factors like client interests, community impact assessment protocols and any other relevant considerations.
We expect the developer to address the security vulnerability within ninety (90) days. If not resolved within this timeframe, Redfox Security reserves the right to release details about the vulnerability in a manner that mitigates its potential harm and encourages further detection of such vulnerabilities. However, vendors may opt to disclose details early if they wish to align their announcement with an official security bulletin release, if technical details are already public due to development practices, or if a fix for affected products has already been implemented. Redfox retains the discretion to delay publishing vulnerability details beyond the 90-day mark if deemed necessary.
Redfox Security follows a responsible disclosure process outlined below:
Our initial outreach seeks to establish secure communication channels through official security disclosure mechanisms provided by the vendor, followed by direct email communication with potentially relevant contacts, and if necessary, outreach via social media channels (using direct messaging, not public channels). If all other methods fail, we may resort to contacting the vendor’s general office phone number.
Sensitive vulnerability details are not shared until a secure communication channel is confirmed. At this initial point of contact, both parties establish an open communication channel and designate one or more points of contact in Redfox Security for collaboration purposes.
Once a secure channel is established, Redfox Security provides the vendor with detailed vulnerability information, including supporting evidence and relevant details for understanding, reproducing, and ideally fixing the vulnerability. This information may include exploitation details, proof of concept code, and any specific replication instructions. Redfox may assist in testing patches provided by vendors to ensure the issue has been effectively addressed. Our communication also includes our intent to publish the vulnerability within 90 days. If the vendor’s resolution or workaround is ready within this timeframe, it will be included in the initial disclosure. Otherwise, it will be published separately when available.
Redfox Security makes reasonable efforts to contact the vendor throughout the 90-day period. However, if the vendor remains unresponsive, fails to address the reported issue within the stipulated timeframe, or disputes the severity of the reported vulnerability, Redfox Security may expedite the disclosure process.
Redfox Security may extend the disclosure period beyond 90 days if the vendor is actively working on a resolution or if disclosing the vulnerability prematurely could expose Redfox Security’s clients to undue risk.
Vulnerabilities deemed disclosable are published on the Redfox Security blog, including details such as impact, replication steps, and in some cases, proof-of-concept code. Any mitigation steps or software patches provided by the vendor may also be included in the disclosure. Redfox Security maintains a public GitHub repository of all disclosed vulnerabilities.
Redfox Security will notify the client immediately of any vulnerabilities discovered through paid engagement, providing technical details and steps to replicate them through standard reporting channels. Redfox Security may also notify relevant third-party vendors if deemed necessary for effective remediation while ensuring client confidentiality.
The overarching goal of this policy and Redfox Security’s approach to disclosure is to enhance overall security for the community. It is not driven by financial motives or a desire for business opportunities. While collaboration with Redfox Security is welcomed, there is no expectation for formal engagement from those notified about vulnerabilities in their solutions.
| CVE ID | Title |
| CVE-2024-25343 | Tenda N300 F3 Router Password Policy Bypass Vulnerability |
| CVE-2024-28325 | Asus RT-N12+ B1’s Credentials Stored in Cleartext |
| CVE-2024-28326 | Asus RT-N12+ B1’s Privilege Escalation via Improper Credential Storage |
| CVE-2024-28327 | Asus RT-N12+ B1’s Insecure Credential Storage |
| CVE-2024-28328 | Asus RT-N12+ B1’s CSV Injection |
| CVE-2024-2257 | Digisol DG-GR1321 Password Policy Bypass |
| CVE-2024-4231 | Digisol DG-GR1321 Incorrect Access Control |
| CVE-2024-4232 | Digisol DG-GR1321 Password Storage in Plaintext |
| CVE-2024-36787 | Netgear WNR614 Improper Authentication |
| CVE-2024-36788 | Netgear WNR614 Cookie Without HTTPOnly / Secure Flag Set |
| CVE-2024-36789 | Netgear WNR614 Password Policy Bypass |
| CVE-2024-36790 | Netgear WNR614 Incorrect Access Control |
| CVE-2024-36792 | Netgear WNR614 WPS PIN Exposure |
| CVE-2024-36795 | Netgear WNR614 Insecure Permissions |
| CVE-2024-33373 | LB-LINK BL-W1210M Inconsistent Password Policy |
| CVE-2024-33374 | LB-LINK BL-W1210M Incorrect Access Control |
| CVE-2024-33375 | LB-LINK BL-W1210M Credentials Stored in Cleartext |
| CVE-2024-34377 | LB-LINK BL-W1210M Clickjacking |
| CVE-2024-41684 | Syrotech SY-GPON-1110-WDONT Cookie Without Secure Flag Set |
| CVE-2024-41685 | Syrotech SY-GPON-1110-WDONT Cookie Without HTTPOnly Flag Set |
| CVE-2024-41686 | Syrotech SY-GPON-1110-WDONT Password Policy Bypass |
| CVE-2024-41687 | Syrotech SY-GPON-1110-WDONT Cleartext Transmission |
| CVE-2024-41688 | Syrotech SY-GPON-1110-WDONT Cleartext Storage |
| CVE-2024-41689 | Syrotech SY-GPON-1110-WDONT Hard-Coded Credentials |
| CVE-2024-41690 | Syrotech SY-GPON-1110-WDONT Default Credential Storage in Plaintext |
| CVE-2024-41691 | Syrotech SY-GPON-1110-WDONT Insecure Storage |
| CVE-2024-41692 | Syrotech SY-GPON-1110-WDONT Incorrect Access Control |
Redfox Cyber Security Inc.
8 The Green, Ste. A, Dover,
Delaware 19901,
United States.
info@redfoxsec.com
©️2024 Redfox Cyber Security Inc. All rights reserved.