Product Security Incident Response
Overview
A coordinated path for product security issues
Synaptics Product Security Incident Response Team (PSIRT) coordinates reports of potential security vulnerabilities with internal teams, customers, partners, and researchers, and helps manage mitigations, fixes, workarounds, and related communications. Disclosure timing may depend on customer integration, field update paths, third-party dependencies, and ecosystem coordination.
Scope
What PSIRT handles
PSIRT is intended for security vulnerability reports involving a potential security vulnerability in a product or system that contains one of our components. General technical support, commercial requests, and non-product security issues should use the appropriate Synaptics support or contact channel.
In scope
- Potential security vulnerabilities in a product or system that contains one of our components reported by researchers, customers, partners, suppliers, or internal teams.
- Security-impacting behavior in features, update mechanisms, configurations, or default settings in a product or system that contains one of our components.
Out of scope
- Commercial solicitation, sales inquiries, or partnership requests.
- Routine product support or integration assistance.
- Website, enterprise IT, phishing, or corporate information security issues unless they are directly tied to Synaptics product security.
- Reports involving personal data submitted without consent or appropriate safeguards.
Report a Vulnerability
How to contact Synaptics PSIRT
If you believe you have identified a potential security vulnerability, email the Synaptics Product Security Incident Response Team at [email protected].
When reporting a potential vulnerability, we ask that you include as much information as possible to help us better understand the nature and scope of the reported issue:
- Your organization and contact name
- Your preferred contact information (email, phone, anonymous)
- Product name and version affected
- Description of the issue
- Date the issue was observed
- Supporting technical detail, including the environment or system information under which the issue was reproduced (for example: product model number, operating system version, and other related information)
- Common Weakness Enumeration (CWE) and Type and/or class of vulnerability (e.g., Cross-site Scripting, buffer overflow, denial of service, remote code execution)
- Step-by-step instructions to reproduce the vulnerability
- Proof-of-concept (code and/or screenshot)
- Potential impact of the vulnerability
Synaptics PSIRT accepts encrypted reports. Synaptics provides a public PGP key to enable secure communications, available here.
When you conduct your security research, you must comply with all applicable laws. You do not have permission to access our systems without our express written permission, and you must not exfiltrate any data from our systems. If you derive data from other sources, you must ensure that you do not include any data in your report that could violate rights of others (including privacy rights or trade secrets) without first obtaining informed consent. You must also properly encrypt and safeguard any sensitive information before submitting it to Synaptics. Synaptics disclaims any liability for any security research, alerts, or information submitted to Synaptics.
[email protected] is ONLY intended for reports of potential security vulnerabilities specific to Synaptics’ products. No commercial solicitation or technical support requests will be accepted at this address. Also, we cannot respond to automated, vague, ambiguous, or unintelligible submissions.
Prohibited Activities
Do not include any data in your report that could violate the privacy of any user without first obtaining informed consent from such user and making arrangements to properly encrypt and safeguard that information before submitting it to Synaptics.
If a vulnerability provides you with access to confidential or non-public information (including third-party data, personal data, or any information marked by Synaptics as Internal Use, Confidential, Highly Confidential, Restricted, or Highly Restricted), you must limit access to such information as minimally necessary to report the vulnerability to Synaptics. Apart from your submission to Synaptics, you must not store, transfer, use, retain, disclose, or copy any such information. For clarity, once you have established that a vulnerability exists or encounter any sensitive data, you should cease further testing, notify Synaptics promptly, and refrain from any further use or disclosure of such data. You must not download, persistently access, or exfiltrate such data.
Synaptics disclaims any liability for personal information submitted to Synaptics without Synaptics’ express request in writing and you have a lawful basis to provide it.
Security Updates
During the supported security maintenance period for an affected product, Synaptics seeks to make available security updates, mitigations, or documented workarounds to address confirmed vulnerabilities where appropriate , taking into account the nature and severity of the vulnerability and technical feasibility. Security updates may be distributed directly by Synaptics or through OEM partners, operating system vendors, or other authorized distribution channels depending on the product.
Regulatory Notifications
Where required by applicable law, Synaptics may notify competent governmental authorities or designated cybersecurity agencies regarding actively exploited vulnerabilities or significant cybersecurity incidents affecting products within the scope of applicable legislation. Such notifications may be made independently of, or in advance of, any public security advisory or coordinated vulnerability disclosure.
Severity and Impact
Synaptics recommends that persons who report vulnerabilities or other security concerns follow industry-standard practices in measuring and reporting vulnerabilities’ potential impact, following the current version of the Common Vulnerability Scoring System (CVSS). Details about the CVSS system can be found here.
If it is possible, we would appreciate a list of known Synaptics components and OEM products that include our components and that are affected by the vulnerability, as well as the appropriate path for obtaining a fix or workaround.
Security Advisories
We may provide security advisories related to our components, including on our website, www.synaptics.com , in the “Related Assets” table of the applicable product page under the Products heading or applications page under the Applications heading.
Where appropriate, we may issue an advisory about a practical workaround or fix in coordination with OEM customers that include our components into their products or systems.
Synaptics evaluates reported vulnerabilities and prioritizes remediation according to severity and risk. Where a vulnerability is confirmed, Synaptics will develop and make available appropriate security updates, taking into account technical feasibility.
Where required by applicable law, Synaptics will notify competent governmental authorities or designated cybersecurity agencies regarding actively exploited vulnerabilities or significant cybersecurity incidents affecting products within the scope of applicable legislation. Such notifications may be made independently of, or in advance of, any public security advisory or coordinated vulnerability disclosure.
Synaptics seeks to remediate and coordinate disclosure of confirmed vulnerabilities as promptly as reasonably practicable. Timeframes vary depending on severity, active exploitation, product complexity, and applicable legal or regulatory obligations.
In cases where a third party, such as a security researcher, notifies us of a potential vulnerability in compliance with applicable laws and our policies, we will investigate and may publish a coordinated disclosure along with such third party. If we receive a report under a confidentiality agreement, we may work with our OEMs to release a security fix, but we may only be able to provide limited information about the vulnerability.
Synaptics does not share verified exploits or proof of concept code for identified vulnerabilities. Additionally, in accordance with industry practices, Synaptics does not share test results or proof of concepts from internal security testing or other types of privileged information with external entities.
Where customers can find security guidance
When Synaptics issues a security advisory, the advisory typically identifies affected Synaptics products, known affected versions where available , severity information, and the appropriate path for obtaining a fix or workaround.