Vulnerability Disclosure Policy
We want the products we make to be secure, and we welcome reports from security researchers, customers and integrators. This page explains how to report a vulnerability to us, what we'll do about it and how we disclose it afterwards.
Scope
This policy covers products with digital elements that Lawnswood Technology Limited places on the market under the RAP SYSTEMS brand:
- the HG1v4 Intelligent HART Gateway, including its firmware, web interface, update mechanism and network services
- the HM1-UD USB HART modem
- our Windows companion tools (HG1Discover and HG1VspManager)
- the secure remote-access service used by HG1v4 gateways, and our firmware update and download servers
Third-party components included in our firmware, such as the Linux kernel and open-source libraries, are in scope if the vulnerability affects our product. Please also report upstream issues to the relevant maintainers.
How to report
Email [email protected]. Where possible, include:
- the product and firmware version (shown on the gateway's System page)
- a description of the vulnerability and its likely impact
- steps to reproduce it, or a proof of concept
- whether you believe it is being actively exploited
- how you would like to be credited, if at all
Reports in English are preferred. Please don't include customer data or other people's personal data in your report.
What happens next
| Stage | Our target |
|---|---|
| Acknowledge your report | Within 5 working days |
| Initial assessment and severity rating (CVSS) | Within 10 working days |
| Progress updates | At least every 30 days until resolved |
| Fix released for critical and high severity issues | As soon as practicable, normally within 90 days |
Security fixes for the HG1v4 are delivered as signed firmware updates through the gateway's built-in update service, free of charge.
Coordinated disclosure
We ask you to give us a reasonable opportunity to fix the issue before you disclose it publicly. We'll agree a disclosure date with you, normally no later than 90 days after your report, or sooner once a fix is available. If we can't meet that date, we'll explain why and agree a new one.
Once a fix is available we publish a security advisory describing the vulnerability, the affected and fixed versions, and any workaround. Where appropriate we request a CVE identifier. We credit reporters who want to be named.
As required by the EU Cyber Resilience Act, we notify actively exploited vulnerabilities and severe security incidents to the relevant authorities through the ENISA single reporting platform.
Safe harbour
We won't take legal action against anyone who reports a vulnerability to us in good faith and in line with this policy. We ask you to:
- test only against equipment you own or are authorised to test
- avoid disrupting live industrial processes, and never test against a plant or system that isn't yours
- access, keep and share only the data you need to demonstrate the issue
- not demand payment in exchange for withholding details
We don't currently run a paid bug bounty programme.
Documented design limitations
Some industrial protocols the gateway supports have no authentication by design. Modbus TCP (port 502), Modbus RTU encapsulated over TCP (port 1100) and the virtual serial port service (port 772) accept connections from the local network without credentials, as the protocols require. Install the gateway on a segmented control network that isn't reachable from the internet or from untrusted networks.
We still welcome reports that show a way to go beyond what these protocols intend, such as reaching the device's operating system or bypassing the remote-access login.
Security advisories
Advisories are published on our support site and noted in the firmware release notes. Keep your gateway up to date: the System Update page shows when a new version is available.