Skip to main content

Report a vulnerability

If you think you've found a security vulnerability in an LCD product or service, email [email protected]. Reports to this address go to the person responsible for product security, not the support queue.

LCD is the trading name of SI Sound and Light Ltd. The full policy is the LCD security policy. This page summarises it.

What to include​

  • The product and its version, for example the 2N Lock driver for Crestron Home and the version shown in its setup app.
  • What the issue is and what an attacker could do with it.
  • Steps to reproduce it, with any proof-of-concept code or screenshots.
  • How you'd like to be credited, if at all.

Don't send passwords, licence keys or other people's personal data. If we need sensitive material from you, ask us for a secure way to transfer it.

What happens next​

  • We acknowledge your report within 3 working days.
  • We tell you whether we've confirmed the issue within 10 working days.
  • We update you at least every 14 days until the report is closed.
  • We aim to release a fix within 90 days of confirming the issue, and agree a publication date with you.
  • We credit you in the advisory if you'd like.

There's no paid bug bounty.

What's in scope​

  • LCD drivers for Crestron Home, including their browser setup and diagnostics apps.
  • LCD licensing and the cloud services our drivers use.
  • Centro products and services.
  • Our websites: lightingcontrol.co.uk, lcd.network and centro.network.

Our products work with equipment and services from other companies, such as Crestron, 2N, Ajax and Sonos. If the issue is in their product, report it to them. If you're not sure who owns an issue, report it to us and we'll help route it.

Testing​

  • Only test systems you own or have permission to test.
  • Stop once you've confirmed the issue. Don't view, change or keep other people's data.
  • Don't disrupt live installations, the licensing service or the websites.

Good-faith research that follows these guidelines is treated as authorised, and we won't take legal action over it.

Security updates​

Security fixes ship as normal driver releases at no extra charge, and the release notes flag them.

note

For installation help, licence questions or faults that aren't security issues, use the support portal instead.