Programs
Companies
Comcast

Comcast bug bounty programs

comcast.com Updated 12 Nov 2026

Comcast runs three public programs: a Bugcrowd bug bounty paying up to $5,500, a Bugcrowd disclosure program with no cash rewards and a self-hosted bug bounty.

Top reward: $5,500; Bugcrowd
Programs: 3; 2 pay cash
Targets in scope: 11; 5 types, deduplicated
Last change: None yet; Tracked since Nov 2026

Where to report

3 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.

Start here

Comcast Xfinity Bug Bounty

Bugcrowd · Pays the most of the 3 programs: up to $5,500.

Comcast programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.
Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
Comcast Xfinity Bug Bounty Bugcrowd · Bug bounty	$5,500 (highest)	$2,500 (highest)	$600 (highest)	$250 (highest)	$5,500	Full	–	–	Open
Comcast Xfinity Vulnerability Disclosure Program Bugcrowd · Disclosure only	–	–	–	–	No cash	Full	–	–	Open
Comcast Self-hosted · Bug bounty	–	–	–	–	Not published	Partial	–	–	Open

Comcast Xfinity Bug Bounty
Bugcrowd · Bug bounty

Open

Top reward
$5,500

Critical

$5,500 (highest)

High

$2,500 (highest)

Medium

$600 (highest)

Low

$250 (highest)

Safe harbor

Full
Comcast Xfinity Vulnerability Disclosure Program
Bugcrowd · Disclosure only

Open

Top reward
No cash

Safe harbor

Full
Comcast
Self-hosted · Bug bounty

Open

Top reward
Not published

Safe harbor

Partial

Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

11 targets across all 3 programs, each listed once with the programs that cover it. 12 excluded.

*.sys.comcast.net

Wildcards

Covered by Comcast Xfinity Vulnerability Disclosure Program
comcast.com

Domains

Covered by Self-hosted
https://business.comcast.com/account

Web

Covered by Comcast Xfinity Vulnerability Disclosure Program
█████████

Web

Covered by Comcast Xfinity Bug Bounty
█████████████

Web

Covered by Comcast Xfinity Bug Bounty
██████████████

Web

Covered by Comcast Xfinity Bug Bounty
███████████████████████████████████████

Web

Covered by Comcast Xfinity Bug Bounty
Flex - Xfinity hardware and services

Hardware and IoT

Covered by Comcast Xfinity Vulnerability Disclosure Program
TV - Xfinity hardware and services

Hardware and IoT

Covered by Comcast Xfinity Vulnerability Disclosure Program
Voice - Hardware and service

Hardware and IoT

Covered by Comcast Xfinity Vulnerability Disclosure Program
https://www.xfinity.com/apps

Products and areas

Covered by Comcast Xfinity Vulnerability Disclosure Program

No target matches. Try part of a host name, such as the company name.

Out of scope 12

Don't test these. A program can exclude a host another program covers; the program you report to decides.

https://www.comcastbiz.net

Comcast Xfinity Vulnerability Disclosure Program
███

Comcast Xfinity Bug Bounty
█████████████████

Comcast Xfinity Bug Bounty
███████████████████

Comcast Xfinity Bug Bounty
████████████████████

Comcast Xfinity Bug Bounty
█████████████████████

Comcast Xfinity Bug Bounty
█████████████████████████

Comcast Xfinity Bug Bounty
████████████████████████████

Comcast Xfinity Bug Bounty
██████████

Comcast Xfinity Bug Bounty
█████████████

Comcast Xfinity Bug Bounty
██████████████

Comcast Xfinity Bug Bounty
███████████████

Comcast Xfinity Bug Bounty

Recent changes

Reward and scope changes across every Comcast program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Comcast products, from the NVD.

Search NVD

CVE-2017-9498 Medium

The Comcast firmware on Motorola MX011ANM (firmware version MX011AN_2.9p6s1_PROD_sey) and Xfinity XR11-20 Voice Remote devices allows local users to upload arbitrary firmware images to an XR11 by leveraging root access. In other words, there is no protection mechanism involving digital signatures for the firmware.
CVE-2017-9498 Medium

The Comcast firmware on Motorola MX011ANM (firmware version MX011AN_2.9p6s1_PROD_sey) and Xfinity XR11-20 Voice Remote devices allows local users to upload arbitrary firmware images to an XR11 by leveraging root access. In other words, there is no protection mechanism involving digital signatures for the firmware.
CVE-2017-9498 Medium

The Comcast firmware on Motorola MX011ANM (firmware version MX011AN_2.9p6s1_PROD_sey) and Xfinity XR11-20 Voice Remote devices allows local users to upload arbitrary firmware images to an XR11 by leveraging root access. In other words, there is no protection mechanism involving digital signatures for the firmware.
CVE-2017-9475 Medium

Comcast XFINITY WiFi Home Hotspot devices allow remote attackers to spoof the identities of Comcast customers via a forged MAC address.
CVE-2017-9475 Medium

Comcast XFINITY WiFi Home Hotspot devices allow remote attackers to spoof the identities of Comcast customers via a forged MAC address.
CVE-2017-9475 Medium

Comcast XFINITY WiFi Home Hotspot devices allow remote attackers to spoof the identities of Comcast customers via a forged MAC address.
CVE-2016-2398 Medium

Comcast XFINITY Home Security System does not properly maintain base-station communication, which allows physically proximate attackers to defeat sensor functionality by interfering with ZigBee 2.4 GHz transmissions.
CVE-2016-2398 Medium

Comcast XFINITY Home Security System does not properly maintain base-station communication, which allows physically proximate attackers to defeat sensor functionality by interfering with ZigBee 2.4 GHz transmissions.

About this page

This page gathers every public program listed under comcast.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.