Product Security Vulnerability

About TMC PSIRT

TMC PSIRT (TMC Product Security Incident Response Team) is a dedicated team focused on quickly addressing security vulnerabilities in TMC products by receiving, verifying, disclosing, and providing remediation. TMC PSIRT is responsible for communication and coordination with all relevant parties (both internal and external).

Report a Potential Security Vulnerability

If you discover a potential security vulnerability in a TMC product, please send the vulnerability information to the TMC PSIRT: psirt@tsinghuaic.com. TMC PSIRT will confirm the submitted vulnerability information within 24 hours.

Due to the sensitivity of vulnerability information, TMC PSIRT strongly recommends encrypting the vulnerability information using the PSIRT PGP key.
PGP Fingerprint：CA7F8AFCE1A74CB07123ABA3545953DFDBBEC152
PGP Public Key：（Click for downloading）

The vulnerability report should include the following information:
1. Identification of TMC Product: Product name and version (Including Software and hardware).
2. Technical details of the vulnerability, including any related exploits
3. How and when the potential vulnerability was discovered
4. Contact information of the reporter
5. Any public information already published or planned to be published (CVE, academic paper publication, etc.)

Vulnerability Handling Process

The TMC PSIRT vulnerability handling process is as follows:
1. Receiving the Vulnerability: TMC PSIRT will confirm the receipt of the vulnerability report.
2. Verify the Vulnerability: TMC PSIRT will analyze the vulnerability and assess its risk.
3. Resolving the Vulnerability: TMC PSIRT will develop a solution for the vulnerability, provide corresponding technical support to the users, and provide guidance to assist users with the secure configuration and installation of the products.
4. Communication: If some information is missed in the original vulnerability report, the TMC PSIRT will contact reporter for more details.

Public security advisories and bulletins

TMC will upload the confirmed vulnerabilities and their corresponding solutions here.