{"id":13396,"date":"2025-09-22T16:07:00","date_gmt":"2025-09-22T15:07:00","guid":{"rendered":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/?p=13396"},"modified":"2025-09-22T16:16:38","modified_gmt":"2025-09-22T15:16:38","slug":"gsma-cvd-programme-reports-another-strong-year","status":"publish","type":"post","link":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/cvd-blog\/gsma-cvd-programme-reports-another-strong-year\/","title":{"rendered":"GSMA CVD Programme Reports Another Strong Year"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">The&nbsp;<a href=\"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/gsma-coordinated-vulnerability-disclosure-programme\/\">GSMA Coordinated Vulnerability Disclosure Programme<\/a>&nbsp;was founded in 2017 to help security researchers report security vulnerabilities and to enable the mobile telecommunication ecosystem to respond to and resolve reported vulnerabilities. Since its introduction, the programme has considered over 100 vulnerability disclosures with&nbsp;<a href=\"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/gsma-mobile-security-research-acknowledgements\/\">53 reports being formally acknowledged<\/a>&nbsp;as increasing the security posture of the mobile industry.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Every year since the programme was started the GSMA has hosted an annual review of the scheme.&nbsp; The review is undertaken by the programme\u2019s&nbsp;<a href=\"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/cvd-panel-of-experts-applications\/\">Panel of Experts<\/a>&nbsp;and provides an opportunity to review the programme\u2019s performance and impact over the past 12 months, as well as an opportunity to look ahead at how the programme should evolve to fulfil future industry needs. This year\u2019s review was completed on the 5<sup>th<\/sup>&nbsp;June 2025.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Overview of GSMA CVD Programme<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The GSMA CVD Programme provides security researchers with a trusted and structured pathway to report vulnerabilities affecting the mobile ecosystem. This approach enables the identification and mitigation of potential threats before they become public, helping to safeguard the security and integrity of mobile networks worldwide.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Through collaboration with mobile operators, vendors, and standards bodies, the GSMA works to develop effective fixes and mitigation strategies that protect customers and uphold trust in mobile communications.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The GSMA actively encourages responsible disclosure of security research, recognising its vital role in strengthening industry-wide defences and enhancing the protection of assets and users. The CVD Programme is purpose-built to support this process, enabling coordinated reporting and resolution of vulnerabilities at scale.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>GSMA CVD Programme Panel of Experts<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The Panel of Experts (PoE) is the group of subject matter experts from GSMA member organisations who assess the risks posed by reported vulnerabilities and consider options for remediation of the vulnerabilities submitted to GSMA via the CVD programme. The PoE comprises&nbsp;<a href=\"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/cvd-panel-of-experts-applications\/\">members<\/a>&nbsp;from a broad cross-section of the mobile industry and they sit on the panel in their personal capacity as subject matter experts, as opposed to representing their employers. PoE activities include technical analysis of vulnerabilities, assessing the impact of submissions, suggesting remediation options and contributing to advisories relating to the vulnerabilities.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The PoE also review the performance and impact of the programme and the highlights noted during this year\u2019s annual review were:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Successful Year for the Programme<\/strong> \u2013\u00a0The panel reviewed the programme\u2019s performance over the past 12 months. In that period the scheme added 3 new acknowledgements to the GSMA website. \u00a0The panel noted that the\u00a0<a href=\"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/gsma_resources\/cvd-researcher-spotlight\/\">feedback received from security researchers<\/a>\u00a0over this period was very positive and the programmes KPI\u2019s for responding to submissions had been met. The panel concluded that the programme was in good health and had provided significant value to the industry.<\/li>\n\n\n\n<li><strong>NCSC Internship Supports GSMA CVD Programme &#8211; <\/strong>In 2024, an undergraduate from the UK\u2019s National Cyber Security Centre (NCSC) successfully completed an analysis project during an internship at the GSMA. The objective was to gather publicly available mobile vulnerability research and assess whether it fell within the scope of the GSMA CVD Programme. The project aimed to identify research that may not have been reaching the GSMA CVD process, with the intention of proactively engaging those researchers and promoting responsible disclosure. The ultimate goal is to provide the mobile industry with early visibility of emerging vulnerabilities, helping to reduce the risk of zero-day exploits. The Panel of Experts reviewed the findings, welcomed the insights, and supported the continuation and expansion of this analysis in future efforts.<\/li>\n\n\n\n<li><strong>PoE Skill Sets Remain Strong and Well-Balanced &#8211;<\/strong> Following the latest recruitment phase in Autumn 2024, which welcomed new talent to the expert panel, the overall skillset of the Panel of Experts (PoE) was reviewed. The assessment concluded that the panel maintains a robust and well-balanced range of expertise, effectively covering all key areas of current mobile network technology. However, it was noted that emerging areas such as mobile money and artificial intelligence (AI) should be monitored closely, with a view to strengthening expertise in these domains if their relevance continues to grow.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Get Involved with the GSMA Coordinated Vulnerability Disclosure (CVD) Programme<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">There are multiple ways to participate in the GSMA CVD Programme\u2014whether you&#8217;re a security researcher looking to report a vulnerability or a GSMA member interested in joining our Panel of Experts.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>For Security Researchers<\/strong><br>We welcome vulnerability submissions from both individuals and organisations. If you have identified a security issue affecting the mobile ecosystem, you are encouraged to report it responsibly in line with the scope of our programme. Detailed guidance on how to submit a vulnerability can be found <a href=\"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/cvd-submit-a-vulnerability\/\">here<\/a>.<\/li>\n\n\n\n<li><strong>For GSMA Member Experts<\/strong><br>If you are a mobile telecommunications security professional working for a GSMA member organisation, you are invited to apply for a position on the CVD Panel of Experts. The next scheduled recruitment round is planned for late 2026, though occasional ad-hoc opportunities may arise. You can register your interest <a href=\"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/cvd-panel-of-experts-applications\/\">here<\/a>.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">For any questions about the programme or to express interest in joining the panel, please contact us at <a href=\"mailto:cvd@gsma.com\">cvd@gsma.com<\/a><strong> <\/strong>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><\/p>\n","protected":false},"excerpt":{"rendered":"<p>The&nbsp;GSMA Coordinated Vulnerability Disclosure Programme&nbsp;was founded in 2017 to help security researchers report security vulnerabilities and to enable the mobile telecommunication ecosystem to respond to and resolve reported vulnerabilities. Since its introduction, the programme has considered over 100 vulnerability disclosures with&nbsp;53 reports being formally acknowledged&nbsp;as increasing the security posture of the mobile industry. Every year [&hellip;]<\/p>\n","protected":false},"author":66,"featured_media":9075,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_oasis_is_in_workflow":0,"_oasis_original":0,"_oasis_task_priority":"","footnotes":""},"categories":[1506,1505],"tags":[],"algolia_discover_type":[],"class_list":["post-13396","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cvd-blog","category-latest-news"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v24.3 (Yoast SEO v24.3) - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>GSMA CVD Programme Reports Another Strong Year - Security<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/cvd-blog\/gsma-cvd-programme-reports-another-strong-year\/\" \/>\n<meta property=\"og:locale\" content=\"en_GB\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"GSMA CVD Programme Reports Another Strong Year - Security\" \/>\n<meta property=\"og:description\" content=\"The&nbsp;GSMA Coordinated Vulnerability Disclosure Programme&nbsp;was founded in 2017 to help security researchers report security vulnerabilities and to enable the mobile telecommunication ecosystem to respond to and resolve reported vulnerabilities. Since its introduction, the programme has considered over 100 vulnerability disclosures with&nbsp;53 reports being formally acknowledged&nbsp;as increasing the security posture of the mobile industry. Every year [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/cvd-blog\/gsma-cvd-programme-reports-another-strong-year\/\" \/>\n<meta property=\"og:site_name\" content=\"Security\" \/>\n<meta property=\"article:published_time\" content=\"2025-09-22T15:07:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-09-22T15:16:38+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-content\/uploads\/2024\/04\/Newsletter-blog-image-1-e1744677812220.png\" \/>\n\t<meta property=\"og:image:width\" content=\"352\" \/>\n\t<meta property=\"og:image:height\" content=\"190\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"ehenderson@gsma.com\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"ehenderson@gsma.com\" \/>\n\t<meta name=\"twitter:label2\" content=\"Estimated reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"GSMA CVD Programme Reports Another Strong Year - Security","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/cvd-blog\/gsma-cvd-programme-reports-another-strong-year\/","og_locale":"en_GB","og_type":"article","og_title":"GSMA CVD Programme Reports Another Strong Year - Security","og_description":"The&nbsp;GSMA Coordinated Vulnerability Disclosure Programme&nbsp;was founded in 2017 to help security researchers report security vulnerabilities and to enable the mobile telecommunication ecosystem to respond to and resolve reported vulnerabilities. Since its introduction, the programme has considered over 100 vulnerability disclosures with&nbsp;53 reports being formally acknowledged&nbsp;as increasing the security posture of the mobile industry. Every year [&hellip;]","og_url":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/cvd-blog\/gsma-cvd-programme-reports-another-strong-year\/","og_site_name":"Security","article_published_time":"2025-09-22T15:07:00+00:00","article_modified_time":"2025-09-22T15:16:38+00:00","og_image":[{"width":352,"height":190,"url":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-content\/uploads\/2024\/04\/Newsletter-blog-image-1-e1744677812220.png","type":"image\/png"}],"author":"ehenderson@gsma.com","twitter_card":"summary_large_image","twitter_misc":{"Written by":"ehenderson@gsma.com","Estimated reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/cvd-blog\/gsma-cvd-programme-reports-another-strong-year\/","url":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/cvd-blog\/gsma-cvd-programme-reports-another-strong-year\/","name":"GSMA CVD Programme Reports Another Strong Year - Security","isPartOf":{"@id":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/cvd-blog\/gsma-cvd-programme-reports-another-strong-year\/#primaryimage"},"image":{"@id":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/cvd-blog\/gsma-cvd-programme-reports-another-strong-year\/#primaryimage"},"thumbnailUrl":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-content\/uploads\/2024\/04\/Newsletter-blog-image-1-e1744677812220.png","datePublished":"2025-09-22T15:07:00+00:00","dateModified":"2025-09-22T15:16:38+00:00","author":{"@id":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/#\/schema\/person\/06397f185befa1985d4ee28109cc2759"},"inLanguage":"en-GB","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/cvd-blog\/gsma-cvd-programme-reports-another-strong-year\/"]}]},{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/cvd-blog\/gsma-cvd-programme-reports-another-strong-year\/#primaryimage","url":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-content\/uploads\/2024\/04\/Newsletter-blog-image-1-e1744677812220.png","contentUrl":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-content\/uploads\/2024\/04\/Newsletter-blog-image-1-e1744677812220.png","width":352,"height":190,"caption":"A digital illustration of a glowing blue padlock surrounded by concentric circles, suggesting cybersecurity. The background features binary code in various shades of blue, creating a high-tech, secure atmosphere."},{"@type":"WebSite","@id":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/#website","url":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/","name":"Security","description":"GSMA Security","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-GB"},{"@type":"Person","@id":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/#\/schema\/person\/06397f185befa1985d4ee28109cc2759","name":"ehenderson@gsma.com","image":{"@type":"ImageObject","inLanguage":"en-GB","@id":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/552d629c24c101f73bb4a908a5ad3d69606c67267f54970cc3b2afdd3743c7e5?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/552d629c24c101f73bb4a908a5ad3d69606c67267f54970cc3b2afdd3743c7e5?s=96&d=mm&r=g","caption":"ehenderson@gsma.com"}}]}},"featured_image_url":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-content\/uploads\/2024\/04\/Newsletter-blog-image-1-e1744677812220.png","_links":{"self":[{"href":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-json\/wp\/v2\/posts\/13396","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-json\/wp\/v2\/users\/66"}],"replies":[{"embeddable":true,"href":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-json\/wp\/v2\/comments?post=13396"}],"version-history":[{"count":3,"href":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-json\/wp\/v2\/posts\/13396\/revisions"}],"predecessor-version":[{"id":13401,"href":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-json\/wp\/v2\/posts\/13396\/revisions\/13401"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-json\/wp\/v2\/media\/9075"}],"wp:attachment":[{"href":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-json\/wp\/v2\/media?parent=13396"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-json\/wp\/v2\/categories?post=13396"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-json\/wp\/v2\/tags?post=13396"},{"taxonomy":"algolia_discover_type","embeddable":true,"href":"https:\/\/www.gsma.com\/solutions-and-impact\/technologies\/security\/wp-json\/wp\/v2\/algolia_discover_type?post=13396"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}