SE050 vulnerability reporting

[djdirkj]

I have a technical support question regarding the SE050. We are bringing a product to market that uses the SE050, and this product will not receive software updates in the field. Under the EU Cyber Resilience Act (CRA), we have an obligation to monitor for vulnerabilities in the components we use and to report actively exploited vulnerabilities and severe incidents within the required timelines.

Could you tell us:

- Does NXP operate a vulnerability disclosure or security notification process for the SE050 (e.g. a mailing list, security advisories page, or PSIRT feed) that we could subscribe to or monitor?

- How are known vulnerabilities and their status (fixed, mitigated, not applicable) communicated to customers using the SE050, given that this specific product line does not support field updates?

- Is there a way to get proactive notifications rather than having to check manually?

[Kan_Li]

Hi @djdirkj ,

[Product Security Vulnerability | NXP Semiconductors|https://www.nxp.com/support/support/product-security-vulnerability:PSIRT] PSIRT team can be reported of vulnerabilities, they evaluate, find apt solution and communicate to affected buyers of the product - direct customers and distis which then inform their buyers.

Errors and mitigiations are documented in errata sheet and user guidance. Anyone can receive updates of these documents by clicking the "receiving alerts" option on the website of the product page to get informed on document updates.

Have a great day,
Kan

-------------------------------------------------------------------------------
Note:
- If this post answers your question, please click the "Mark Correct" button. Thank you!
- We are following threads for 7 weeks after the last post, later replies are ignored
Please open a new thread and refer to the closed one, if you have a related question at a later point in time.
-------------------------------------------------------------------------------