Handling Vulnerability Reports
Dell believes in maintaining a good relationship with security researchers and we acknowledge them in our advisories (if desired). In return, we ask that researchers give us an opportunity to remediate the vulnerability before publicly disclosing it. Dell believes that coordinating the public disclosure of a vulnerability is key to protecting our customers.
All information about vulnerabilities disclosed according to this policy is intended to remain private between Dell and the reporting party (if the information is not already public knowledge) until a remedy is available and disclosure activities are coordinated.
Vulnerability Remediation
After investigating and validating a reported vulnerability, Dell will develop and qualify the appropriate remedy for products that are under active support from Dell. A remedy may take one or more of the following forms:
Dell makes every effort to provide the remedy or corrective action in the shortest commercially reasonable time. Response timelines will depend on many factors: the severity, the remedy complexity, the component that is affected (for example, some updates require longer validation cycles or can only be updated in a major release), the stage of the product within its lifecycle, etc.
Remedy Communication
Dell will communicate remedies to customers through Dell Security Advisories where applicable. To protect Dell customers, Security Advisories are released once Dell has remedies in place for all supported versions of the affected product(s). Dell may release Security Advisories sooner to respond appropriately to public disclosures or widely known vulnerabilities in the components used within Dell products.
Security Advisories are intended to provide sufficient details to allow customers to assess the impact of vulnerabilities and to remedy potentially vulnerable products. Full details may be limited to reduce the likelihood that malicious users could take advantage of the information and exploit it to the detriment of our customers.
Dell Security Advisories will include the following information where applicable:
Dell Security Advisories and Notices can be accessed on www.dell.com/support/security.
Severity Rating
A security vulnerability is classified by its severity rating, which is determined by many factors, including the level of effort required to exploit a vulnerability as well as the potential impact to data or business activities from a successful exploit. Dell uses the Common Vulnerability Scoring System version 3.0 (CVSS v3.0) to identify the severity level of identified vulnerabilities. The full standard, which is maintained by the Forum of Incident Response and Security Teams (FIRST), can be found at https://www.first.org/cvss.
When and where applicable, Dell Security Advisories will provide the CVSS v3.0 Base Score, corresponding CVSS v3.0 Vector, and the CVSS v3.0 Severity Rating Scale for identified vulnerabilities. Dell recommends that all customers take into account both the base score and any temporal and/or environmental scores that may be relevant to their environment to assess their overall risk.
Additional Disclosure Information
Dell releases Security Advisories to all customers simultaneously and its policy is not to provide advance notification to individual customers. This ensures that all customers are protected while a remedy is being created and receive proper information to remediate the vulnerability. Certain vulnerabilities may require multi-party coordination among industry partners before they are publicly disclosed.
Dell’s policy is not to provide additional information about the specifics of vulnerabilities beyond what is provided in the Security Advisory and related documentation such as release notes, knowledgebase articles, FAQs, etc. Dell does not distribute exploit/proof of concept code for identified vulnerabilities.
In accordance with industry practices, Dell’s policy is not to share the findings from internal security testing or other types of security activities with external entities.
Notifying Dell of other Security Issues
If you need to report any other security issue to Dell, please use the appropriate contacts listed below:
Security Issue | Contact Information |
How to report a security vulnerability or issue in Dell online service, web application or property | Submit a report at https://bugcrowd.com/dell with step-by-step instructions to reproduce the issue. |
How to report spam and phishing emails | Contact Missed_SPAM@dell.com. |
How to report a security issue to Dell Financial Services | See Dell Financial Services Security page. |
How to submit privacy related requests or questions | See Dell Privacy page. |
Customer Entitlements: Warranties, Support, and Maintenance
Dell customers’ entitlements with respect to warranties and support and maintenance—including vulnerabilities in any Dell software product—are governed by the applicable agreement between Dell and each customer. The statements on this web page don’t modify or enlarge any customer rights or create any additional warranties.