Spectrum Brands Vulnerability Disclosure Policy

Please note that you can download a copy of this policy by clicking the “Download” button at the bottom of this page.

• Document Number: CYB-POL-001
• Version: 1.0
• Policy Owner: Regulatory, Compliance & Quality Department
• Approved By: Spectrum Brands Senior Management
• Effective Date: [Insert Date]
• Review Frequency: Annual

1. Purpose

Spectrum Brands is committed to the security and resilience of its connected products, software, and digital services.

This Vulnerability Disclosure Policy establishes a process by which customers, security researchers, suppliers and other interested parties may responsibly report potential cybersecurity vulnerabilities affecting products or services supplied by Spectrum Brands.

The objectives of this policy are to:

• Promote responsible vulnerability reporting.
• Enable timely identification and remediation of security issues.
• Protect consumers from cybersecurity risks.
• Support compliance with applicable cybersecurity requirements, including ETSI EN 303 645 Clause 5.2 and the UK Product Security and Telecommunications Infrastructure (PSTI) Regulations.

2. Scope

This policy applies to:

• Connected consumer products marketed by Spectrum Brands.
• Embedded software and firmware.
• Mobile applications associated with connected products.
• Cloud-based services supporting connected products.
• Web portals, APIs and supporting digital services managed by Spectrum Brands.

Examples include, but are not limited to:

• Connected home appliances.
• Smart home devices.
• Associated mobile applications.
• Supporting cloud services.

3. Reporting a Security Vulnerability

Security vulnerabilities should be reported to:

Email: productsecurity@spectrumbrands.com

Alternative Contact: compliance@spectrumbrands.com

Reports should include:

• Name and contact details of the reporter.
• Product name and model number.
• Firmware or software version, where known.
• Description of the vulnerability.
• Steps required to reproduce the issue.
• Any supporting evidence, including screenshots, logs or proof-of-concept material.
• Assessment of potential impact, if known.

4. Spectrum Brands Commitment

Upon receipt of a vulnerability report, Spectrum Brands will:

• Acknowledge receipt within five (5) business days.
• Review and triage the reported vulnerability.
• Determine whether the issue is valid and within scope.
• Provide updates, where appropriate, regarding investigation progress.
• Develop and implement corrective actions where justified.
• Coordinate disclosure activities to minimise risk to consumers.
• Maintain records of vulnerability reports and remediation activities.

5. Responsible Disclosure Principles

Spectrum Brands supports responsible and coordinated vulnerability disclosure.

Researchers are requested to:

• Act in good faith.
• Avoid unnecessary privacy violations or service disruption.
• Refrain from exploiting vulnerabilities beyond what is necessary to demonstrate the issue.
• Avoid accessing, modifying or deleting customer or company data.
• Avoid introducing malware or conducting denial-of-service activities.
• Allow Spectrum Brands a reasonable opportunity to investigate and remediate issues before public disclosure.

6. Vulnerability Handling Process

6.1 Intake

All reported vulnerabilities are logged in the Spectrum Brands Product Security Register and assigned a unique reference number.

6.2 Validation

The Product Security Team will assess whether the reported issue:

• Is reproducible.
• Impacts a Spectrum Brands product or service.
• Represents a genuine cybersecurity vulnerability.

6.3 Risk Assessment

Confirmed vulnerabilities will be evaluated based on:

• Ease of exploitation.
• Potential impact on consumers.
• Potential impact on confidentiality, integrity and availability.
• Safety implications.
• Regulatory implications.

6.4 Remediation

Where corrective action is required, Spectrum Brands may:

• Issue firmware updates.
• Release software patches.
• Implement configuration changes.
• Provide consumer guidance.
• Introduce additional monitoring or mitigations.

6.5 Closure

The vulnerability record will be closed once:

• Remediation has been implemented,
• Mitigation measures have been provided, or
• The issue has been determined not to represent a security vulnerability.

7. Coordinated Public Disclosure

Spectrum Brands may publicly disclose confirmed vulnerabilities after:

• Appropriate remediation has been made available, or
• Risk mitigation measures have been communicated to affected users.

Researchers will be encouraged to coordinate disclosure activities with Spectrum Brands to support consumer protection.

Where requested and appropriate, Spectrum Brands may acknowledge researchers who have responsibly disclosed vulnerabilities.

8. Security Updates

Where vulnerabilities require corrective action, Spectrum Brands will make reasonable efforts to provide security updates consistent with product support commitments, technical feasibility and applicable legal requirements.

Information relating to available security updates may be communicated through:

• Product support websites.
• Firmware or software release notices.

9. Privacy and Confidentiality

Information submitted under this policy will be used solely for investigating and managing reported vulnerabilities.

Personal information will be processed in accordance with applicable data protection legislation, including the UK GDPR and EU GDPR where applicable.

10. Policy Governance

The Regulatory, Compliance & Quality Department shall be responsible for:

• Maintaining this policy.
• Monitoring incoming vulnerability reports.
• Coordinating investigations with engineering, quality and information security functions.
• Retaining records of vulnerability reports and corrective actions.
• Conducting annual policy reviews.

Public Security Contact Statement

https://en.russellhobbs.com/declaration-of-conformity

The following statement should also be published on the Spectrum Brands website to satisfy the ETSI EN 303 645 requirement for a publicly accessible vulnerability reporting mechanism:

Security Vulnerability Reporting

Spectrum Brands welcomes reports relating to potential cybersecurity vulnerabilities affecting our connected products and services.

If you believe you have identified a security vulnerability, please provide details to:

productsecurity@spectrumbrands.com

We will acknowledge receipt of your report and investigate the matter in accordance with our Vulnerability Disclosure Policy.

https://uk.russellhobbs.com/vulnerability-disclosure-policy

To submit a report, please visit our customer support portal.

https://help.russellhobbs.com/hc/en-gb/requests/new?ticket_form_id=40813321294225