NETGEAR Bug Bounty Policy

1. Overview

At NETGEAR, our mission is to unlock the full potential of connectivity through innovative, reliable, and secure networking solutions. Protecting our customers, their devices, and their data is central to that mission.

We welcome reports from independent researchers who discover security vulnerabilities in our products and services. This policy establishes the terms under which security researchers may safely test, report, and receive recognition or rewards for findings that affect NETGEAR products.

By participating in the NETGEAR Bug Bounty Program, you agree to comply with this policy. NETGEAR commits to working transparently with researchers and will not pursue legal action against anyone who discovers and reports vulnerabilities in good faith under these terms.

Guiding principles

• Coordinated disclosure: we request a reasonable amount of time to investigate the issue and implement appropriate remediation before any public disclosure.
• Good-faith testing: researchers must avoid customer data access, service disruption, and unauthorized persistence.
• Recognition and rewards: eligible reports receive acknowledgments and may receive financial rewards.
  
  

2. Scope - In-Service Products

Only currently supported, in-service products are eligible for financial rewards. NETGEAR's support status page at https://www.netgear.com/about/eos is the authoritative source for product lifecycle status.

Examples of in-scope hardware products include:

• Consumer and business routers
• Mesh WiFi systems
• Mobile routers and hotspots
• Cable modems and gateways
• Wireless access points
• Network switches
  
  

In-scope Applications, Cloud Services, and Websites:

• NETGEAR Insight platform
• NETGEAR iOS/Android Apps and backend APIs
• netgear.com and all NETGEAR-managed subdomains
  
  

3. Out-of-Scope and Exclusions

The following report types are expressly excluded from the scope of the bug bounty program. Submissions that fall into these categories are not eligible for bounty rewards or recognition.

Out-of-scope products and web properties

• Products that have reached End of Service, subject to the limited exception described in Section 4. This includes, but is not limited to, products identified at www.netgear.com/about/eos.
• NETGEAR-branded products sold under OEM or white-label arrangements by other vendors
• community.netgear.com, survey.netgear.com
  
  

Out-of-scope vulnerability types

• Any security issue affecting a NETGEAR product that is not eligible for CVE assignment under the CVE Program’s CNA Rules.

• Exploits targeting mobile applications that require physical access to the device or actions that void the device warranty (e.g., rooting the device)
• Vulnerabilities requiring destructive or invasive physical access to the device, including hardware manipulation or disassembly, with no broader software exploitation path.
• Social engineering or phishing attacks against NETGEAR employees or customers
• Denial-of-service (DoS) attacks without RCE or data exposure potential
• Self-XSS or issues requiring the victim to execute their own attacker-controlled code
• Clickjacking without demonstrated meaningful impact
• SSL/TLS configuration issues without a working proof-of-concept demonstrating data interception
• Rate limiting or account lockout issues without a demonstrated credential or data exposure vector
• Missing HTTP security headers without a direct exploitation path
• Theoretical vulnerabilities - a working proof-of-concept is required
• Automated scanner or tool output without manual validation and triage
• Publicly disclosed vulnerabilities without demonstrated security impact
• Password or credential strength policies
  
  

Prohibited testing activities

• Testing against devices you do not own. Instead, use lab equipment or your own registered devices
• Accessing, modifying, or exfiltrating any customer data
• Causing availability impact to NETGEAR services or customer devices
• Introducing backdoors, malware, or persistent access mechanisms
• Submitting vulnerabilities discovered via third-party bug bounty aggregators without direct coordination
  
  

4. End-of-Service and End-of-Life Products

Products that have reached end-of-service (EoS) or end-of-life (EoL) status and no longer receive firmware updates are not eligible for financial bug bounty rewards. However, NETGEAR recognizes the importance of responsible research on older hardware that may still be in active use by customers. Where CVE assignment is within the scope of NETGEAR’s CVE Numbering Authority, NETGEAR will publish a CVE record for the reported vulnerability to alert customers about such risks affecting end-of-service products.

5. Severity Classification

NETGEAR uses the CVSS 4.0 scoring system to determine the severity of reported issues. It is important to note that confidentiality, integrity, and availability impacts are determined in the context of the specific product’s functionality and not as a general-purpose OS or library, and only an increase in access, privileges gained, or other negative outcome as a result of successful exploitation are considered when assessing the impact metrics of a vulnerability.

For example, if exploitation gives the administrator no additional capability and causes no impact to a vulnerable or subsequent system beyond actions the administrator is already authorized to perform, the CVSS Base score may be 0.0.

6. Bug Bounty Awards

Rewards are offered at NETGEAR's discretion for valid, in-scope vulnerabilities to researchers in good standing. The following criteria must be met for a report to be eligible for a financial reward.

Eligibility criteria

• First reporter - the vulnerability has not been publicly disclosed, previously reported by another researcher, or discovered internally.
• Valid and reproducible - the issue is confirmed by NETGEAR engineers using the steps provided.
• In-service product - the affected product or service is currently supported and expressly in scope.
• Policy compliance - the researcher has followed all terms of this policy, including prohibited testing restrictions.
• Reported through the correct channel: security@netgear.com. Reports that were disclosed to a third party, a coordinator, another CNA, or a different email at NETGEAR or partner are not eligible.
• Truthful and in good faith – reports that mischaracterize the vulnerability or the security impact with the intention of receiving a higher award may be disqualified.
  
  

Reward determination

The reward amount depends on several factors and is not published in a fixed award chart:

• Severity of the vulnerability
• Number and prevalence of the products in use
• Year the product was placed in market
• Completeness and accuracy of the report
• A working proof of concept
• Accurate and truthful characterization of the security impact
• Accuracy and truthfulness of the CVSS score
• A specific suggested fix and prevention technique
• A reproducible explanation of how the vulnerability was discovered

For example, a complete, high-quality, and high-severity finding in a popular product, where researcher’s assessment aligns with ours will generally receive a higher reward than a low-impact report affecting a product that is approaching end-of-life. Final amounts are at NETGEAR's discretion.

Payment

Monetary rewards are disbursed exclusively through Bugcrowd. Eligible participants must maintain a valid Bugcrowd account to receive any monetary rewards. NETGEAR reserves the right to withhold rewards for reports that violate this policy, involve prohibited testing activities, or lack adequate reproduction steps. Rewards for the same root-cause vulnerability present across multiple products are consolidated into a single payment at the highest applicable tier.

7. Disclosure and Acknowledgements

Security Advisories are published on the NETGEAR Security Advisories page. Public disclosure is coordinated to maximize user safety. Researchers may be credited on advisories at their discretion. Advisories for issues that require immediate attention are published as soon as reasonably possible. Other addressed vulnerabilities may be included in NETGEAR’s monthly security patch updates.

• CVE credit: the reporting researcher’s name and any affiliation will be credited as the discoverer in the CVE record unless they request not to be acknowledged.
• Hall of fame listing: all valid EoS/EoL disclosures that result in a published CVE, or that NETGEAR independently validates as genuine security findings, will receive a named or handle-based listing in the NETGEAR Security Researcher Hall of Fame.
• Kudos acknowledgment: researchers who do not wish to be named publicly can request a private acknowledgment from the NETGEAR Product Security Team.

To qualify for EoS/EoL recognition, a report must provide a clear and comprehensive description of the issue, detailed step-by-step reproduction instructions, and a functional proof of concept demonstrated on a real hardware device. NETGEAR will not assign CVEs or offer hall of fame credit for theoretical, unverified, or scanner-generated reports against EoS/EoL products.

Note: Bug bounty rewards are not available for EoS/EoL products regardless of severity. NETGEAR does not commit to patching EoS/EoL products; however, we may publish a security advisory to inform customers still running affected firmware.

8. What a Good Report Looks Like

Clear, well-structured reports receive faster triage and higher rewards. Please ensure that each submission includes the following components:

1. Title

A one-line summary identifying the vulnerability type and affected component. For example: "Unauthenticated command injection in Nighthawk R500 via /setup.cgi firmware upload handler."

2. Affected product and version
Product name, model number, firmware version, and hardware revision. Confirm whether the issue is still present in the latest available firmware. For example: "Orbi RBE871 - firmware V9.2.1.4.1 - confirmed present in V9.2.1.6.0."

3. Vulnerability type and CVSS score

The CWE category (e.g., CWE-78: OS Command Injection) and your CVSS 4.0 score with the full vector string.

4. Description

What the vulnerability is, where it exists in the code or interface, and why it occurs. Include relevant request and response headers, affected parameters, or code snippets.

5. Step-by-step reproduction

Numbered steps a NETGEAR engineer can follow to reproduce the issue from scratch, including all prerequisites such as device setup, firmware version, and network configuration. If the issue is exploitable only from a specific network position (e.g., LAN-side only), state this clearly.

6. Proof of concept

A working exploit, curl commands, Burp Suite project file, or script. Attach as a file (please do not embed live exploit payloads in the report body).

7. Impact statement

What can an attacker achieve with this vulnerability? What data or systems are at risk, and who is affected (e.g., all LAN users, any WAN attacker, all cloud subscribers)?

8. Suggested remediation

Optional but appreciated: recommendations for remediating the issue.

9. Acknowledgements

List of names and affiliations to be included in the security advisory or the CVE record or the request to keep these confidential.

10. Attachments

Screenshots, screen recordings, packet captures, extracted firmware binaries, and proof-of-concept scripts.

9. Safe Harbor

NETGEAR will not pursue civil or criminal action against researchers who discover and report security vulnerabilities in good faith under the terms of this policy.

NETGEAR considers research to be conducted in good faith when researchers stay within the authorized scope, refrain from accessing customer data or disrupting products or services, promptly report vulnerabilities, and maintain confidentiality throughout the coordinated disclosure process.

To maintain safe harbor status, researchers must:

• Test only on hardware they own or have explicit permission to test.
• Stop testing immediately upon discovery of customer data and report what was accessed.
• Not access, copy, modify, or destroy any data belonging to NETGEAR customers.
• Not disclose the vulnerability publicly before coordinating with NETGEAR.
• Not use the vulnerability for any purpose other than demonstrating its impact in the report.
  
  

10. Terms and Conditions

The following terms and conditions govern participation in the NETGEAR Bug Bounty Program. Additional restrictions may apply under local law.

1. The parties to this Agreement are you and NETGEAR.
2. "NETGEAR" refers to NETGEAR, Inc. and its affiliates.
3. By submitting a security vulnerability, you confirm that you have not publicly disclosed it and agree to follow a coordinated disclosure process with NETGEAR. You must give NETGEAR a reasonable opportunity to investigate and address the vulnerability before disclosing it to any third party. Any disclosure that does not follow this process constitutes a violation of this Agreement.
4. Participants must be legally permitted to receive bug bounty awards.
5. You must not be subject to any applicable sanctions, including sanctions administered or maintained by the U.S. Office of Foreign Assets Control (OFAC) or the European Union. You must also not be employed by, affiliated with, or otherwise associated with any individual or organization subject to applicable sanctions, including any person or entity identified on the OFAC sanctions lists.
6. You must not be a citizen or resident of, or submit a report from, any country or territory subject to applicable U.S. or European Union sanctions, embargoes, or trade restrictions, as identified by the relevant authorities.
7. By submitting information about a potential security bug, you are granting NETGEAR a worldwide, royalty-free, non-exclusive license to use your submission for the purpose of addressing security bugs in NETGEAR’s products and services.
8. In the event of substantially duplicate submissions, NETGEAR may at its discretion provide a Reward only for the earliest received submission. Eligibility for Rewards, determination of the recipients, and amount of Reward is at the discretion of NETGEAR.
9. If issues reported to our bug bounty program affect a third party or another vendor, NETGEAR reserves the right to share details of the issue with that third party without further discussion with the researcher.
10. You are responsible for all taxes associated with and imposed on any Reward you may receive from NETGEAR.
11. You may only exploit, investigate, or target security bugs against your own accounts and/or your own devices. Testing must not violate any law or disrupt or compromise any data or access data that is not yours; intentional access to customer data belonging to individuals other than yourself is strictly prohibited.
12. If you inadvertently access proprietary customer, employee, or business-related information during your testing, the information must not be used, disclosed, stored, or recorded in any way. Inadvertent access to the data must be declared within your submission.
13. Your testing activities must not negatively impact NETGEAR, NETGEAR’s products or services generally, or NETGEAR's online environment availability or performance.
14. NETGEAR may choose not to remediate at its sole discretion.
15. This Agreement constitutes the entire agreement of the parties with respect to the items listed above. This Agreement is governed by California law.
16. If any portion of this Agreement is found to be illegal or unenforceable, then the parties will be relieved of their responsibilities arising under such portion, but only to the extent that such portion is illegal or unenforceable.
17. You must not be the author of the code with the vulnerability.
18. You must not be a current or former NETGEAR employee, contractor, or a family member of an employee or contractor.
    
    

NETGEAR RESERVES THE RIGHT TO MODIFY OR CANCEL THE NETGEAR BUG BOUNTY PROGRAM AT ANY TIME WITHOUT NOTICE. ALL PARTICIPANTS AND SUBMISSIONS ARE STRICTLY VOLUNTARY. THIS OFFER IS VOID WHERE PROHIBITED BY LAW AND IN PARTICIPATING, YOU MUST NOT VIOLATE ANY LAW. YOU ALSO MUST NOT DISRUPT ANY SERVICE OR COMPROMISE ANYONE’S DATA.

11. Contact

For general product support or non-security issues, please contact NETGEAR Support at https://www.netgear.com/support/. The security mailbox is monitored exclusively for security vulnerability disclosures.

Revision Effective: 8 October 2026

© 2026 NETGEAR, Inc. All Rights Reserved.