CVSS-10 in a vendor's template catalog, no security contact. Pressure-test my disclosure plan.
First disclosure I've run at this severity. I want to get the process right, not learn it the hard way. Looking for people who've run vendor disclosures to push back on the plan below.
What I found: CVSS 10.0 in a vendor's automated provisioning. Unauthenticated remote, full data compromise, plausible RCE. Default-credentials class, not a novel exploit. The fix on their end is roughly one line per template.
What makes it worse: the same pattern shows up across multiple templates I checked. Looks systemic to how that class of templates is generated, not one bad apple. The affected population is anyone who provisioned from those templates. They were exposed from the moment of deployment, with nothing flagging the issue. Patching the templates only protects new deployments. Every existing instance stays exposed until someone individually remediates it.
Constraints:
- No security.txt, no security contact, no bounty. General support email and a ticket system only.
- Reported through their available channels, flagging that it looks catalog-wide rather than a single template. Treating this as the start of a coordinated process.
- Working PoC. Nothing published.
My plan if they don't engage:
- Re-report through every channel with a dated acknowledgment window.
- If the window lapses with no response: publish an advisory with vuln class and remediation only. No PoC, no exploit code. Request a CVE via MITRE since the vendor isn't a CNA.
- Hold the full writeup and PoC until a fix has shipped and existing exposed deployments have been addressed.
Questions for people who've run vendor disclosures:
- When the defect is systemic and existing deployments stay exposed regardless of the template fix, is "advisory with remediation, no PoC" the right balance? Or does protecting that population justify going further, or pulling back?
- What's a defensible acknowledgment window for a vendor with no security program, and how do you document good-faith contact so it holds up if it gets contentious later?
- How do you push a vendor to audit a whole catalog rather than patch only the one template you named, without handing them an excuse to stall?
- MITRE as CNA-of-last-resort when the affected party isn't a CNA: realistic path, and does MITRE want a public reference at submission time?
- Anything in this plan that would make someone experienced wince?
Keeping the vendor, components, and specific templates out of it while remediation is in progress. This is a process question, not an attempt to crowdsource an ID. Tell me what I'm missing.
Thanks a lot for your time.
