1. Purpose and Scope
This Policy establishes the framework for Westell Technologies, Inc. to disclose security vulnerabilities affecting its products. As a CVE Numbering Authority (CNA) under the CISA Top-Level Root hierarchy, Westell assigns CVE identifiers and publishes CVE Records in compliance with the CNA Operational Rules.
2. CNA Scope
Westell assigns CVE IDs for vulnerabilities affecting all Westell Technologies, Inc. products, including active support, limited support, and End-of-Life products. Third-party component vulnerabilities are referred to the appropriate upstream CNA.
3. Reporting a Vulnerability
Report vulnerabilities to:
- Email: security@westell.com
- Portal: Secure Reporting Portal
Acknowledgment within 3 business days.
4. Coordinated Disclosure
Aligned with ISO/IEC 29147. We work with reporters to verify vulnerabilities, provide regular updates, give advance notice of disclosure dates, and credit reporters in advisories and CVE Records.
5. Embargo Policy
Standard 90-day embargo from initial report. May be extended by mutual agreement or shortened if active exploitation is detected.
6. Response Timeline
CVE ID requests responded to within 72 hours. Remediation targets:
- Critical (9.0–10.0): Emergency patch within 30 days; full fix within 90 days
- High (7.0–8.9): Patch within 90 days
- Medium (4.0–6.9): Next scheduled release or 180 days
- Low (0.1–3.9): Future release
7. Advisory Publication
Advisories published at www.westell.com/security/advisories, second Wednesday of each month at 4:00 PM GMT.
8. Safe Harbor
Westell will not pursue legal action against researchers who: report in good faith, avoid privacy violations and data destruction, maintain confidentiality during the embargo, and do not exploit beyond demonstration.
9. End-of-Life Products
CVE IDs assigned for EOL products, tagged “unsupported-when-assigned.” Advisories include migration guidance. See Product Lifecycle Policy.
10. Compliance
Westell operates under CNA Operational Rules v4.1.0, CVE Terms of Use, CVSS v3.1, and includes CWE identifiers in CVE Records.
Security advisories are provided “as is” without warranty. Use at recipient’s own risk.
Checking for a downloadable copy…