Agent WranglersIOT-37Recommended
Make every report and advisory name the model and firmware version
The app and the device label show each device's model, and the app shows its firmware version. Every security advisory lists the affected models, the affected firmware versions and the first fixed version.
How to do it
A researcher's report and an owner's question both start with which device and which version. ETSI EN 303 645 provision 5.3-16 asks that the model be clear on the device or its interface. Publish a disclosure policy with a contact and reply times, as publish a security policy describes. Point to it from security.txt. ETSI provision 5.2-1 makes that policy mandatory. Fix within the time each severity allows, and publish the advisory as publish an advisory for every fixed vulnerability says. Report exploited holes under report exploited vulnerabilities.
How to check
An app test reads the model and firmware version of each test device. A check over published advisories fails on any advisory without models, affected versions and a fixed version.
Sources
Related rules
- ENG-44 Publish a security policy with the code in Engineering
- WEB-143 Tell people how to report a hole in Website
- SEC-107 Fix each finding within the time its severity allows in Adversarial testing
- CMP-73 Publish an advisory for every fixed vulnerability in Compliance and governance
- CMP-49 Report exploited vulnerabilities in your products in Compliance and governance
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/connected-devices/support-and-vulnerability-reports/model-and-version">Agent Wranglers connected devices playbook</a>. In code you write, add a comment next to it with the same link.