Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Swisscom Ltd bug bounty programs

swisscom.ch Updated

Swisscom Ltd runs one public program: a self-hosted bug bounty paying up to $10,000.

Top reward
$10,000
Self-hosted
Programs
1
1 pays cash
Targets in scope
166
4 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Swisscom Ltd runs.

  • Swisscom

    Self-hosted · Bug bounty

    Open

    Top reward

    $10k
    Safe harbor
    None

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

166 targets. 81 excluded.

  • *.079.ch

    Wildcards

  • *.adapt-solutions.ch

    Wildcards

  • *.ajila.com

    Wildcards

  • *.audiovideo-sa.ch

    Wildcards

  • *.axept.ch

    Wildcards

  • *.blue-plus.ch

    Wildcards

  • *.blue.ch

    Wildcards

  • *.bluecinema.ch

    Wildcards

  • *.bluenews.ch

    Wildcards

  • *.blueplus.ch

    Wildcards

  • *.bluewin.ch

    Wildcards

  • *.cablex-toolbox.ch

    Wildcards

  • *.cablex.ch

    Wildcards

  • *.conextrade.com

    Wildcards

  • *.crowdinsider.ch

    Wildcards

  • *.cura-med.ch

    Wildcards

  • *.curabill.ch

    Wildcards

  • *.digital.deals

    Wildcards

  • *.digitalassessment.ch

    Wildcards

  • *.digitalone.ch

    Wildcards

  • *.directories.ch

    Wildcards

  • *.directoriesdata.ch

    Wildcards

  • *.e-directories.ch

    Wildcards

  • *.ealarm-safemode.ch

    Wildcards

  • *.ealarmstarter.ch

    Wildcards

No target matches. Try part of a host name, such as the company name.

Out of scope 81

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • *.7layers.it

  • *.admeira.ch

  • *.adunit.ch

  • *.adunit.tech

  • *.autosense-cloud.com

  • *.autosense.ch

  • *.camptocamp.ch

  • *.camptocamp.com

  • *.camptocamp.de

  • *.camptocamp.fr

  • *.camptocamp.net

  • *.camptocamp.org

  • *.coopmobile.ch

  • *.cust.swisscom.ch

  • *.cust.swisscom.net

  • *.cust.wingo.ch

  • *.custodigit.com

  • *.datasport.ch

  • *.energie-klimapioniere.ch

  • *.fastweb.it

  • *.getkickbox.com

  • *.homepagetool.ch

  • *.hospitality.swisscom.com

  • *.hostcenter.com

  • *.internet-box.ch

  • *.klimapioniere.ch

  • *.local.fr

  • *.mila.cloud

  • *.mila.com

  • *.mtf-ti.ch

  • *.mtfcloud.ch

  • *.mystrom.ch

  • *.oniva.events

  • *.parato.ch

  • *.paybillag.com

  • *.pcwtag.itservices.ch

  • *.pub.wingo.ch

  • *.rnas-dyn.bluewin.ch

  • *.sbc-nms.ch

  • *.sbctv.ch

  • *.scene7.com

  • *.sfsnet.ch

  • *.sitefree.ch

  • *.swisscom-printshop.ch

  • *.swisscom-umfrage.ch

  • *.tiko-energy.ch

  • *.tiko-energy.com

  • *.tiko.at

  • *.tiko.ch

  • *.tiko.de

  • *.tiko.energy

  • *.tiko.fr

  • *.tiko.info

  • *.tiko.net

  • *.tiko.services

  • *.tiko.swiss

  • *.tiko.uk

  • *.tikoenergy.com

  • *.vodafone.it

  • *.zoon.ch

  • amag.supportcenter.autosense-cloud.com

  • autodiscover.mtf-ti.ch

  • confluence.camptocamp.com

  • fiberdoc.cablex.ch

  • grafana.rk8s.94946.mtfcloud.ch

  • helion.supportcenter-dev.autosense-cloud.com

  • jira.camptocamp.com

  • keycloak.rk8s.94946.mtfcloud.ch

  • mail.mtf-ti.ch

  • outlook.mtf-ti.ch

  • prometheus.rk8s.94946.mtfcloud.ch

  • route-server-bi.ce.ip-plus.net

  • route-server.ce.ip-plus.net

  • shop.m-budget.migros.ch

  • swisscom.ecommerce-benchmark.com

  • swisscom.shirthouse.ch

  • swisscomsolutions.vpch.ch

  • webapp.rk8s.94957.mtfcloud.ch

  • https://github.com/swisscom/bugbounty/blob/main/scope/inscope.txt

  • https://github.com/swisscom/bugbounty/blob/main/scope/outofscope.txt

  • 193.247.168.0/21

Recent changes

Reward and scope changes across every Swisscom Ltd program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Swisscom Ltd products, from the NVD.

Search NVD
  • CVE-2020-16134 High

    An issue was discovered on Swisscom Internet Box 2, Internet Box Standard, Internet Box Plus prior to 10.04.38, Internet Box 3 prior to 11.01.20, and Internet Box light prior to 08.06.06. Given the (user-configurable) credentials for the local Web interface or physical access to a device's plus or reset button, an attacker can create a user with elevated privileges on the Sysbus-API. This can then

  • CVE-2019-19940 High

    Incorrect input sanitation in text-oriented user interfaces (telnet, ssh) in Swisscom Centro Grande before 6.16.12 allows remote authenticated users to execute arbitrary commands via command injection.

  • CVE-2019-19941 Medium

    Missing hostname validation in Swisscom Centro Grande before 6.16.12 allows a remote attacker to inject its local IP address as a domain entry in the DNS service of the router via crafted hostnames in DHCP requests, causing XSS.

  • CVE-2019-19942 High

    Missing output sanitation in Swisscom Centro Grande Centro Grande before 6.16.12, Centro Business 1.0 (ADB) before 7.10.18, and Centro Business 2.0 before 8.02.04 allows a remote attacker to perform DNS spoofing against the web interface via crafted hostnames in DHCP requests.

  • CVE-2018-16596 High

    A stack-based buffer overflow in the LAN UPnP service running on UDP port 1900 of Swisscom Internet-Box (2, Standard, and Plus) prior to v09.04.00 and Internet-Box light prior to v08.05.02 allows remote code execution. No authentication is required to exploit this vulnerability. Sending a simple UDP packet to port 1900 allows an attacker to execute code on a remote device. However, this is only po

  • CVE-2018-16225 Medium

    The QBee MultiSensor Camera through 4.16.4 accepts unencrypted network traffic from clients (such as the QBee Cam application through 1.0.5 for Android and the Swisscom Home application up to 10.7.2 for Android), which results in an attacker being able to reuse cookies to bypass authentication and disable the camera.

  • CVE-2018-6765 High

    Swisscom MySwisscomAssistant 2.17.1.1065 contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system. This vulnerability exists due to the way .dll files are loaded. It allows an attacker to load a .dll of the attacker's choosing that could execute arbitrary code without the user's knowledge. The specific flaw exists within the han

  • CVE-2018-6766 High

    Swisscom TVMediaHelper 1.1.0.50 contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system. This vulnerability exists due to the way .dll files are loaded. It allows an attacker to load a .dll of the attacker's choosing that could execute arbitrary code without the user's knowledge. The specific flaw exists within the handling of

About this page

This page gathers every public program listed under swisscom.ch: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.