{"id":16,"date":"2019-03-15T13:29:32","date_gmt":"2019-03-15T13:29:32","guid":{"rendered":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/?page_id=16"},"modified":"2026-04-30T13:42:45","modified_gmt":"2026-04-30T12:42:45","slug":"gsma-coordinated-vulnerability-disclosure-programme","status":"publish","type":"page","link":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/gsma-coordinated-vulnerability-disclosure-programme\/","title":{"rendered":"Coordinated vulnerability disclosure programme <\/gsma>"},"content":{"rendered":"\n
\n
<\/span>\"\"
\n

Coordinated vulnerability disclosure (CVD) programme <\/t-isac><\/t-isac><\/h1>\n\n\n\n

Supporting researchers and the wider ecosystem resolve vulnerabilities and protect customer security<\/p>\n\n\n\n

<\/div><\/div>\n<\/div><\/div>\n<\/div>\n\n\n\n
<\/div>\n\n\n\n

The aim of the CVD programme<\/h2>\n\n\n\n

We invite both private individuals and organisations to report vulnerabilities to the GSMA in a responsible manner that is in line with our programme scope.<\/p>\n\n\n\n

Where appropriate, CVD submissions and countermeasures are also added to the relevant GSMA reference document. You can find out more about submitting a vulnerability to the programme here<\/a>.<\/p>\n\n\n\n

GSMA regards the security of mobile network infrastructure and customer equipment such as devices, as essential to the provision of secure and trustworthy services by its members.<\/p>\n\n\n\n

The GSMA coordinated vulnerability disclosure (CVD) programme gives security researchers<\/a> a route to disclose a vulnerability impacting the mobile ecosystem meaning the impact can be mitigated before it enters the public domain. We work with mobile operators, suppliers and standards bodies to develop fixes and mitigating actions to protect customers\u2019 security and trust in the mobile communications industry.<\/p>\n\n\n\n

We encourage disclosure of security research which enhances security levels and better protects assets and customers, and our coordinated vulnerability disclosure programme is designed to support the reporting and remediation of security vulnerabilities at industry level.<\/p>\n\n\n\n

\n
Download our CVD Information booklet<\/a><\/div>\n<\/div>\n\n\n\n
<\/div>\n\n\n\n
\n

CVD process<\/p>\n\n\n\n

\n
\"Flow<\/figure><\/div><\/div><\/div>\n<\/div>\n\n\n\n
\n

GSMA Member CVD programme<\/p>\n\n\n\n

\n

The GSMA CVD Programme addresses security vulnerabilities impacting the mobile industry, with a focus on open standards-based technologies. Vulnerabilities affecting the services or products of a specific manufacturer or company should be reported directly to that organisation.
Researchers looking to report a company-specific vulnerability can consult the list of company CVD programmes available here<\/a>. If the company you wish to contact is not listed, please reach out to us at security@gsma.com, and we will try to assist you.<\/p>\n<\/div><\/div>\n<\/div>\n\n\n\n

\n

CVD disclaimer<\/p>\n\n\n\n

\n

The GSMA responsibilities and any other activities carried out as part of the GSMA Coordinated vulnerability disclosure programme are provided \u201cas is\u201d, without any warranty of any kind. All warranties, whether expressed or implied, or statutory, including without limitation any implied or other warranties of merchantability, fitness for a particular purpose, non-infringement, quality, accuracy, completeness, title or quite enjoyment are expressly disclaimed and excluded.<\/p>\n\n\n\n

As this programme is designed to benefit the safety of mobile networks and users, the CVD Governance Team, the GSMA, its staff and members do not warrant or assume any liability for the responsibilities of this programme, or ‘validation of submissions’ and any other activities or milestones set forth by the GSMA. Each beneficiary of this activity will engage in this offering without reliance or any representation and \/or warranty of the other parties and all such representations and\/or warranties are, to the greatest extent permitted by applicable law, hereby disclaimed.<\/p>\n\n\n\n

Owners or providers of an offering that has been identified by a finder as having a vulnerability will only be given details of such vulnerability under this programme. The vulnerability must be validated in accordance with the GSMA Coordinated vulnerability disclosure process.<\/p>\n\n\n\n

GSMA Operator, Associate and Rapporteur Members interested in applying to join the CVD panel of experts can find out more details here<\/a>.<\/p>\n\n\n\n

NOTE:\u00a0<\/strong>Non-3GPP compliant implementations, open-source software implementations\u00a0and\/or\u00a0deployments of mobile network elements could lead to incorrect findings. Extrapolating from such results to all existing implementations must be done with caution. While GSMA CVD does recognize the usefulness of such tooling for security research we would like to remind all researchers that implementation specific findings are most of the time not applicable for CVD submission and shall be reported to the manufacturer. Please always ensure the tooling used is configured correctly before conducting security research.<\/p>\n\n\n\n

\n

<\/p>\n\n\n\n

<\/div>\n<\/div>\n<\/div><\/div>\n<\/div>\n\n\n\n
\n
\n
\n
<\/span>\"Woman
\n

Security research acknowledgements<\/p>\n\n\n\n

<\/p>\n\n\n\n

\n
Find out more<\/a><\/div>\n<\/div>\n<\/div><\/div>\n<\/div>\n\n\n\n
\n
<\/span>\"Woman
\n

CVD programme assets<\/p>\n\n\n\n

<\/p>\n\n\n\n

\n
Find out more<\/a><\/div>\n<\/div>\n<\/div><\/div>\n\n\n\n
\n
\n
<\/div>\n\n\n\n
<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n\n\n\n
<\/div>\n\n\n\n

Please note: <\/strong>Recognition in the Mobile Security Research Acknowledgements page<\/a> is for identifying vulnerabilities which affect mobile industry standards and services, NOT<\/strong> for those pertaining to GSMA Assets listed below.<\/p>\n\n\n\n