Purpose
Infoblox’s Product Security Incident Response Team (PSIRT) is a global team that receives, investigates, and publicly reports security vulnerabilities in Infoblox products. The policy sets out how security researchers can report issues and what they can expect in return.

How to report

• Email [email protected] or [email protected], or use the online vulnerability disclosure form.
• Include the affected product and version, a description and security impact, reproduction steps or proof of concept, prerequisites, and your contact details.
• Say whether the issue has already been reported to another CNA or disclosed publicly.

Safe harbor

• Infoblox will not take legal action against, or suspend the accounts of, researchers who report in good faith and follow the policy, and it considers such research “authorized” under the Computer Fraud and Abuse Act.
• Safe harbor does not cover third-party products or services. Testing those is at the researcher’s own risk.
• Infoblox will confirm to a third party, on request, that your testing of eligible Infoblox systems was authorized.
• If you’re unsure whether your activity complies, contact Infoblox first.

What counts as noncompliance

• Publicly disclosing submission details without Infoblox’s written consent. This does not limit Infoblox’s own CVE or advisory publication, or earlier disclosure to protect customers, address active exploitation, or comply with law.
• Accessing, downloading, or modifying data in accounts that aren’t yours.
• Attempting denial-of-service attacks.
• Posting, uploading, or storing malicious software.
• Sending spam or other unsolicited or duplicative messages as part of testing.
• Testing in ways that could degrade Infoblox properties.
• Testing third-party applications or services that integrate with or link to Infoblox.

Infoblox’s commitments

• Work with the reporter to understand and validate the issue.
• Address the risk where the PSIRT deems it appropriate.
• Acknowledge and triage reports within the stated targets.
• Assign CVE IDs for eligible in-scope vulnerabilities and share them with the reporter.
• Publish the CVE Record and a public advisory per the CVE Program Rules.

Contact: [email protected]