{"id":1231,"date":"2020-04-06T09:57:34","date_gmt":"2020-04-06T08:57:34","guid":{"rendered":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/?page_id=1231"},"modified":"2026-06-15T11:54:45","modified_gmt":"2026-06-15T10:54:45","slug":"gsma-members-vulnerability-disclosure-programmes","status":"publish","type":"page","link":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/gsma-coordinated-vulnerability-disclosure-programme\/gsma-members-vulnerability-disclosure-programmes\/","title":{"rendered":"GSMA Members’ Vulnerability Disclosure Programmes"},"content":{"rendered":"\n

Please see below our directory of GSMA member companies may also have their own vulnerability disclosure programmes. GSMA is not responsible for the vulnerability disclosure process of member companies. Please see guidance GSMA has put together about setting up a CVD programme<\/a>.<\/p>\n\n\n\n

The GSMA’s industry Coordinated Vulnerability Disclosure Programme<\/a> considers vulnerabilities affecting open standards based technologies which are not proprietary to a specific vendor but that are used across, or have significant impact on, the mobile industry. GSMA also has it’s own disclosure process for vulnerabilities affecting GSMA assets or services<\/a>.<\/p>\n\n\n\n

A<\/a> B<\/a> C D<\/a> E<\/a> F G H<\/a> I J K<\/a> L M<\/a> N<\/a> O<\/a> P<\/a> Q<\/a> R S<\/a> T<\/a> U<\/a> V<\/a> W X Y Z<\/a><\/strong><\/p>\n\n\n\n

<\/a>
<\/a>A1 Responsible Disclosure<\/strong>
w: https:\/\/www.a1.net\/responsible-disclosure<\/a>
e: responsible-disclosure@a1.at<\/a>
Verified: 10 July 2020<\/p>\n\n\n\n

AT&T<\/strong>
w: https:\/\/hackerone.com\/att<\/a>
Verified: 10 July 2020
<\/a>
Blackberry<\/strong>
w: https:\/\/www.blackberry.com\/us\/en\/services\/blackberry-incident-response-team<\/a>
e: secure@blackberry.com<\/a>
Verified: 10 July 2020<\/p>\n\n\n\n

BT<\/strong>
w: https:\/\/hackerone.com\/bt<\/a>
e: UK: security@bt.com<\/a> or Non-UK: security@eu.bt.net<\/a>
Verified: 10 July 2020
<\/a>
Deutsche Telekom Bug Bounty program<\/strong>
w: http:\/\/telekom.com\/bugbounty<\/a>
e: cert@telekom.de<\/a>
Verified: 10 July 2020
<\/a>
Ericsson PSIRT<\/strong>
w: https:\/\/www.ericsson.com\/en\/about-us\/enterprise-security\/psirt<\/a>
e: psirt@ericsson.com<\/a>
Verified: 10 July 2020
<\/a>
Hewlett Packard<\/strong>
w: https:\/\/www.hpe.com\/h41268\/live\/index_e.aspx?qid=11503<\/a>
e: security@hpe.com<\/a>
Verified: 10 July 2020<\/p>\n\n\n\n

HTC<\/strong>
w: https:\/\/www.htc.com\/uk\/terms\/product-security\/<\/a>
e: security@htc.com<\/a>
Verified: 10 July 2020<\/p>\n\n\n\n

Huawei CVD Programme<\/strong>
w: https:\/\/www.huawei.com\/en\/psirt\/report-vulnerabilities<\/a>
e: psirt@huawei.com<\/a>
Verified: 10 July 2020
<\/a>
KPN N.V. CVD Programme<\/strong>
w: https:\/\/www.kpn.com\/algemeen\/missie-en-privacy-statement\/security-vulnerability.htm<\/a>
e: cert@kpn-cert.nl<\/a>
Verified: 10 July 2020
<\/a>
MTN Group<\/strong>
w: https:\/\/hackerone.com\/mtn_group<\/a>
Verified: 10 July 2020
<\/a>
NCSC UK<\/strong>
w: https:\/\/hackerone.com\/ncsc_uk<\/a>
Verified: 10 July 2020<\/p>\n\n\n\n

Nokia Responsible Vulnerability Disclosure<\/strong>
w: https:\/\/www.nokia.com\/responsible-disclosure\/<\/a>
e: security-alert@nokia.com<\/a>
Verified: 10 July 2020
<\/a>
Oracle<\/strong>
w: https:\/\/www.oracle.com\/corporate\/security-practices\/assurance\/vulnerability\/reporting.html<\/a>
e: secalert_us@oracle.com<\/a>
Verified: 10 July 2020<\/p>\n\n\n\n

Orange Group<\/strong>
w: https:\/\/cert.orange.com\/<\/a>
e: cert@orange.com<\/a>
Verified: 10 July 2020
<\/a>
Palo Alto Networks<\/strong>
w: https:\/\/security.paloaltonetworks.com\/Report<\/a>
e: psirt@paloaltonetworks.com<\/a>
Verified: 10 July 2020<\/p>\n\n\n\n

Proximus Group<\/strong>
w: https:\/\/www.proximus.com\/investors\/regulatory-information.html#title-4<\/a>
e: responsible.disclosure@proximus.com<\/a>
Verified: 10 July 2020
<\/a>
Qualcomm<\/strong>
w: https:\/\/www.qualcomm.com\/company\/product-security\/report-a-bug<\/a>
e: product-security@qualcomm.com<\/a>
Verified: 10 July 2020
<\/a>
Samsung Mobile<\/strong>
w: https:\/\/security.samsungmobile.com\/securityReporting.smsb<\/a>
e: mobile.security@samsung.com<\/a>
Verified: 10 July 2020<\/p>\n\n\n\n

Sierra Wireless<\/strong>
w: https:\/\/www.sierrawireless.com\/company\/security\/report-an-issue\/<\/a>
e: security@sierrawireless.com<\/a>
Verified: 12 February 2021<\/p>\n\n\n\n

Sky<\/strong>
w: https:\/\/www.sky.com\/help\/articles\/responsible-disclosure<\/a>
Verified: 10 July 2020<\/p>\n\n\n\n

Sony<\/strong>
w: https:\/\/hackerone.com\/sony<\/a>
Verified: 10 July 2020<\/p>\n\n\n\n

Swisscom Bug Bounty Program<\/strong>
w: https:\/\/www.swisscom.ch\/en\/about\/company\/portrait\/network\/security\/bug-bounty.html<\/a>
Verified: 10 July 2020
<\/a>
Tele2<\/strong>
w: https:\/\/www.tele2.nl\/thuis\/internet\/veilig-internetten\/stappenplan\/<\/a>
e: cert@t-mobile.nl<\/a>
Verified: 10 July 2020<\/p>\n\n\n\n

Telecom Italia Responsible Disclosure<\/strong>
w: https:\/\/www.telecomitalia.com\/tit\/en\/footer\/responsible-disclosure.html<\/a>
e: responsible-disclosure@telecomitalia.it<\/a>
Verified: 10 July 2020<\/p>\n\n\n\n

Telefonica Germany<\/strong>
w: https:\/\/bugcrowd.com\/telefonicavdp<\/a>
Verified: 10 July 2020<\/p>\n\n\n\n

Telefonica Group<\/strong>
w: https:\/\/www.telefonica.com\/en\/web\/about_telefonica\/privacy-centre\/security<\/a>
Verified: 10 July 2020<\/p>\n\n\n\n

Telenet Group<\/strong>
w: https:\/\/www.intigriti.com\/programs\/telenet\/telenet\/detail<\/a>
Verified: 10 July 2020
<\/a>
u-blox<\/strong>
w: https:\/\/www.u-blox.com\/en\/report-security-issues<\/a>
e: security@u-blox.com<\/a>
Verified: 12 January 2021
<\/a>
Verizon Media<\/strong>
w: https:\/\/hackerone.com\/verizonmedia<\/a>
Verified: 10 July 2020<\/p>\n\n\n\n

Vodafone Group<\/strong>
w: https:\/\/hackerone.com\/Vodafone<\/a>
e: responsible.disclosure@vodafone.com<\/a>
Verified: 10 July 2020<\/p>\n\n\n\n

Vodafone Netherlands<\/strong>
w: https:\/\/www.vodafone.nl\/over-deze-website\/privacy-en-disclaimer\/report-security-leak.shtml<\/a>
Verified: 10 July 2020
<\/a>
ZTE<\/strong>
w: https:\/\/www.zte.com.cn\/global\/cybersecurity\/ztepsirt\/bug-bounty<\/a>
Verified: 12 May 2021<\/p>\n\n\n\n

Contact us to add or amend your organisation’s details.<\/strong><\/p>\n\n\ncvd@gsma.com<\/a><\/span>\n","protected":false},"excerpt":{"rendered":"

Please see below our directory of GSMA member companies may also have their own vulnerability disclosure programmes. GSMA is not responsible for the vulnerability disclosure process of member companies. Please see guidance GSMA has put together about setting up a CVD programme. The GSMA’s industry Coordinated Vulnerability Disclosure Programme considers vulnerabilities affecting open standards based […]<\/p>\n","protected":false},"author":50,"featured_media":0,"parent":16,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_oasis_is_in_workflow":0,"_oasis_original":0,"_oasis_task_priority":"","footnotes":""},"tags":[],"class_list":["post-1231","page","type-page","status-publish","hentry"],"yoast_head":"\nGSMA Members' Vulnerability Disclosure Programmes - Security<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/gsma-coordinated-vulnerability-disclosure-programme\/gsma-members-vulnerability-disclosure-programmes\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"GSMA Members' Vulnerability Disclosure Programmes - Security\" \/>\n<meta property=\"og:description\" content=\"Please see below our directory of GSMA member companies may also have their own vulnerability disclosure programmes. GSMA is not responsible for the vulnerability disclosure process of member companies. Please see guidance GSMA has put together about setting up a CVD programme. The GSMA’s industry Coordinated Vulnerability Disclosure Programme considers vulnerabilities affecting open standards based […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/gsma-coordinated-vulnerability-disclosure-programme\/gsma-members-vulnerability-disclosure-programmes\/\" \/>\n<meta property=\"og:site_name\" content=\"Security\" \/>\n<meta property=\"article:modified_time\" content=\"2026-06-15T10:54:45+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"2 minutes\" \/>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"GSMA Members' Vulnerability Disclosure Programmes - Security","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/gsma-coordinated-vulnerability-disclosure-programme\/gsma-members-vulnerability-disclosure-programmes\/","og_locale":"en_GB","og_type":"article","og_title":"GSMA Members' Vulnerability Disclosure Programmes - Security","og_description":"Please see below our directory of GSMA member companies may also have their own vulnerability disclosure programmes. GSMA is not responsible for the vulnerability disclosure process of member companies. Please see guidance GSMA has put together about setting up a CVD programme. The GSMA’s industry Coordinated Vulnerability Disclosure Programme considers vulnerabilities affecting open standards based […]","og_url":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/gsma-coordinated-vulnerability-disclosure-programme\/gsma-members-vulnerability-disclosure-programmes\/","og_site_name":"Security","article_modified_time":"2026-06-15T10:54:45+00:00","twitter_card":"summary_large_image","twitter_misc":{"Estimated reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/gsma-coordinated-vulnerability-disclosure-programme\/gsma-members-vulnerability-disclosure-programmes\/","url":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/gsma-coordinated-vulnerability-disclosure-programme\/gsma-members-vulnerability-disclosure-programmes\/","name":"GSMA Members' Vulnerability Disclosure Programmes - Security","isPartOf":{"@id":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/#website"},"datePublished":"2020-04-06T08:57:34+00:00","dateModified":"2026-06-15T10:54:45+00:00","breadcrumb":{"@id":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/gsma-coordinated-vulnerability-disclosure-programme\/gsma-members-vulnerability-disclosure-programmes\/#breadcrumb"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/gsma-coordinated-vulnerability-disclosure-programme\/gsma-members-vulnerability-disclosure-programmes\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/gsma-coordinated-vulnerability-disclosure-programme\/gsma-members-vulnerability-disclosure-programmes\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Coordinated vulnerability disclosure programme","item":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/gsma-coordinated-vulnerability-disclosure-programme\/"},{"@type":"ListItem","position":2,"name":"GSMA Members’ Vulnerability Disclosure Programmes"}]},{"@type":"WebSite","@id":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/#website","url":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/","name":"Security","description":"GSMA Security","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"}]}},"_links":{"self":[{"href":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-json\/wp\/v2\/pages\/1231","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-json\/wp\/v2\/users\/50"}],"replies":[{"embeddable":true,"href":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-json\/wp\/v2\/comments?post=1231"}],"version-history":[{"count":44,"href":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-json\/wp\/v2\/pages\/1231\/revisions"}],"predecessor-version":[{"id":14467,"href":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-json\/wp\/v2\/pages\/1231\/revisions\/14467"}],"up":[{"embeddable":true,"href":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-json\/wp\/v2\/pages\/16"}],"wp:attachment":[{"href":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-json\/wp\/v2\/media?parent=1231"}],"wp:term":[{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-json\/wp\/v2\/tags?post=1231"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}