Assa Abloy Americas
Vulnerability disclosure program on HackerOne assaabloy.com
- Top reward
- No cash rewards
- Top severity paid
- Critical
- Assets in scope
- 36
- Public CVEs
- 19
- Last change
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report on HackerOne
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What HackerOne lists as the payout for each severity.
This program does not pay cash rewards.
- Safe harbor
-
Full
ASSA ABLOY will not initiate, pursue, or recommend any law enforcement or civil lawsuits related to the specific actions taken by you to discover a security vulnerability, provided that such actions were undertaken in good faith, for the sole purpose of improving the overall security of our products
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
36 assets you may test.
Web 21
- adamsrite.com Critical No bounty
- https://accentra.assaabloy.com Critical No bounty
- https://bittings.medeco.com Critical No bounty
- https://ca-roa.medeco.com Critical No bounty
- https://controlid.com.br Critical No bounty
- https://eacconfig.assaabloy.com Critical No bounty
- https://goconcourse.com Critical No bounty
- https://idsecure.com.br Critical No bounty
- https://keycontrol.medeco.com Critical No bounty
- https://knowledge.openingsstudio.com Critical No bounty
- https://kwiksetunite.com Critical No bounty
- https://level.co Critical No bounty
- https://manage.openingsstudio.com Critical No bounty
- https://roa.assaabloy.net Critical No bounty
- https://roa.medeco.com Critical No bounty
- https://test-bittings.medeco.com Critical No bounty
- https://test-keycontrol.medeco.com Critical No bounty
- https://test-roa.medeco.com Critical No bounty
- https://yale.accentra.assaabloy.com Critical No bounty
- https://yaleconnecthub.com Critical No bounty
- https://yalelatinoamerica.com Critical No bounty
Android apps 8
- https://play.google.com/store/apps/details?id=br.com.controlid.rhid&hl=en&gl=US Critical No bounty
- https://play.google.com/store/apps/details?id=co.level.app Critical No bounty
- https://play.google.com/store/apps/details?id=com.assaabloy.accentra.access Critical No bounty
- https://play.google.com/store/apps/details?id=com.assaabloy.centrIosAppStore Critical No bounty
- https://play.google.com/store/apps/details?id=com.assaabloy.yaleconnect Critical No bounty
- https://play.google.com/store/apps/details?id=com.kwikset.blewifi Critical No bounty
- https://play.google.com/store/apps/details?id=com.luxerone.mobile.residentapp Critical No bounty
- https://play.google.com/store/apps/details?id=com.yale.multifamconftool Critical No bounty
iOS apps 7
- https://apps.apple.com/cr/app/yale-connect/id1204336886 Critical No bounty
- https://apps.apple.com/in/app/centrIosAppStore/id6449100322 Critical No bounty
- https://apps.apple.com/us/app/kwikset/id1465996742?ls=1 Critical No bounty
- https://apps.apple.com/us/app/level-home/id1490027518 Critical No bounty
- https://apps.apple.com/us/app/luxer-one/id1440094075 Critical No bounty
- https://apps.apple.com/us/app/rhid/id1493410750 Critical No bounty
- https://apps.apple.com/us/app/yale-accentra-access/id1523678122 Critical No bounty
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Assa Abloy Americas (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Make a good-faith effort to avoid harm to ASSA ABLOY Americas, our customers, and our end-users — including, but not limited to, privacy violations, destruction of data, and interruption or degradation of our services.
-
Do not access or attempt to access ASSA ABLOY Americas offices, data centers, or user accounts.
-
Do not test for spam, perform phishing, conduct social engineering, or intentionally cause denial of service issues for ASSA ABLOY Americas services.
-
Do not access or attempt to access our customers' or end-users' offices, data centers, or user accounts, or attempt other forms of penetration testing without the direct, written approval of the system owner.
-
Comply with all applicable laws and regulations. Do not disrupt or compromise any data that is not your own, or further exploit a confirmed vulnerability.
-
If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via HackerOne Support before going any further.
Not accepted
-
HTML Injection
-
Rate limiting
-
HTTP headers without an associated, exploitable vulnerability
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope removed
https://centriosappstore.com
-
Scope added
adamsrite.com
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2026-3315 | Incorrect Default Permissions, : Execution with Unnecessary Privileges, : Incorrect Permission Assignment for Critical Resource vulnerability in ASSA ABLOY Visionline on Windows allows Configuration/Environment Manipulation.This issue affects Visionline: from 1.0 before 1.33. | Medium 5.8 | 10 Mar 2026 |
| CVE-2025-49851 | ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to an improper authentication vulnerability which could allow an attacker to bypass authentication and gain permissions in the product. | High 8.7 | 24 Jun 2025 |
| CVE-2025-49852 | ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to a server-side request forgery vulnerability which could allow an unauthenticated attacker to retrieve information from other servers. | High 8.7 | 24 Jun 2025 |
| CVE-2025-49853 | ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to SQL injections which could allow an attacker to leak arbitrary information and insert arbitrary SQL syntax into SQL queries. | Critical 9.3 | 24 Jun 2025 |
| CVE-2025-2125 | A vulnerability has been found in Control iD RH iD 25.2.25.0 and classified as problematic. This vulnerability affects unknown code of the file /v2/report.svc/comprovante_marcacao/?companyId=1 of the component PDF Document Handler. The manipulation of the argument nsr leads to improper control of resource identifiers. The attack can be initiated remotely. The vendor was contacted early about this | Medium 5.3 | 9 Mar 2025 |
| CVE-2023-26941 | Weak encryption mechanisms in RFID Tags in Yale Conexis L1 v1.1.0 allows attackers to create a cloned tag via physical proximity to the original. | Medium 6.5 | 5 Dec 2023 |
| CVE-2023-26942 | Weak encryption mechanisms in RFID Tags in Yale IA-210 Alarm v1.0 allows attackers to create a cloned tag via physical proximity to the original. | Medium 6.5 | 5 Dec 2023 |
| CVE-2023-26943 | Weak encryption mechanisms in RFID Tags in Yale Keyless Lock v1.0 allows attackers to create a cloned tag via physical proximity to the original. | Medium 6.5 | 5 Dec 2023 |
| CVE-2023-4392 | A vulnerability was found in Control iD Gerencia Web 1.30 and classified as problematic. Affected by this issue is some unknown functionality of the component Cookie Handler. The manipulation leads to cleartext storage of sensitive information. The attack may be launched remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed | Low 3.7 | 17 Aug 2023 |
| CVE-2023-33367 | A SQL injection vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing unauthenticated attackers to write PHP files on the server's root directory, resulting in remote code execution. | Critical 9.8 | 5 Aug 2023 |
| CVE-2023-33368 | Some API routes exists in Control ID IDSecure 4.7.26.0 and prior, exfiltrating sensitive information and passwords to users accessing these API routes. | Medium 6.5 | 3 Aug 2023 |
| CVE-2023-33369 | A path traversal vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing attackers to delete arbitrary files on IDSecure filesystem, causing a denial of service. | Critical 9.1 | 3 Aug 2023 |
| CVE-2023-33370 | An uncaught exception vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing attackers to cause the main web server of IDSecure to fault and crash, causing a denial of service. | High 7.5 | 3 Aug 2023 |
| CVE-2023-33371 | Control ID IDSecure 4.7.26.0 and prior uses a hardcoded cryptographic key in order to sign and verify JWT session tokens, allowing attackers to sign arbitrary session tokens and bypass authentication. | Critical 9.8 | 3 Aug 2023 |
| CVE-2023-2043 | A vulnerability, which was classified as problematic, was found in Control iD RHiD 23.3.19.0. This affects an unknown part of the file /v2/customerdb/operator.svc/a of the component Edit Handler. The manipulation of the argument email leads to sql injection. It is possible to initiate the attack remotely. The identifier VDB-225921 was assigned to this vulnerability. NOTE: The vendor was contacted | Medium 6.3 | 14 Apr 2023 |
| CVE-2023-2044 | A vulnerability has been found in Control iD iDSecure 4.7.29.1 and classified as problematic. This vulnerability affects unknown code of the component Dispositivos Page. The manipulation of the argument IP-DNS leads to cross site scripting. The attack can be initiated remotely. VDB-225922 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure b | Low 3.5 | 14 Apr 2023 |
| CVE-2020-23826 | The Yale WIPC-303W 2.21 through 2.31 camera is vulnerable to remote command execution (RCE) through command injection via the HTTP API. NOTE: This may be a duplicate of CVE-2020-10176 | High 8.8 | 26 Jan 2021 |
| CVE-2020-10176 | ASSA ABLOY Yale WIPC-301W 2.x.2.29 through 2.x.2.43_p1 devices allow Eval Injection of commands. | Critical 9.8 | 7 May 2020 |
| CVE-2019-13604 | There is a short key vulnerability in HID Global DigitalPersona (formerly Crossmatch) U.are.U 4500 Fingerprint Reader v24. The key for obfuscating the fingerprint image is vulnerable to brute-force attacks. This allows an attacker to recover the key and decrypt that image using the key. Successful exploitation causes a sensitive biometric information leak. | Medium 5.9 | 15 Jul 2019 |
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Ratings / Rewards
For the initial prioritization and rating of findings, this program will use the HackerOne Vulnerability Rating Taxonomy. It's important to note that in some cases a vulnerability priority will be modified based on its likelihood or impact. In any instance where an issue is downgraded, a full, detailed explanation will be provided to the researcher — along with the opportunity to appeal and make a case for a higher priority.
Credentials
Please sign up for your own accounts using your @wearehackerone.com email address.
Out of Scope
Please note that we cannot authorize out-of-scope testing on third-party products or services. Vulnerabilities discovered in third-party products or services should be reported to the appropriate vendor.
The following are explicitly out of scope:
- HTML Injection
- Rate limiting
- HTTP headers without an associated, exploitable vulnerability
Reporting
Please use the Report Vulnerability tab to submit a finding, or visit our partner HackerOne at https://hackerone.com/vulnerability-rating-taxonomy.
Disclosure
ASSA ABLOY Americas will follow standard industry practices for coordinated and responsible vulnerability disclosure. We ask all vulnerability reporters to do the same — please allow ASSA ABLOY Americas the opportunity to verify and remediate reported vulnerabilities and to notify affected customers and users before you disclose or share the vulnerability or exploitation methods with any third party.
ASSA ABLOY Americas product security advisories will be made publicly available at https://www.assaabloydss.com/en/resource-center/security-center/product-security-advisories and/or communicated directly to affected customers.
Safe Harbor
ASSA ABLOY believes that ethical security research performed in good faith provides an invaluable public service and has therefore provided this safe harbor program to encourage lawful, authorized security testing of our products and services.
Accordingly, ASSA ABLOY will not initiate, pursue, or recommend any law enforcement or civil lawsuits related to the specific actions taken by you to discover a security vulnerability, provided that such actions were undertaken in good faith, for the sole purpose of improving the overall security of our products and services, and not for any nefarious or otherwise unlawful purpose.
ASSA ABLOY considers any actions undertaken in compliance with this policy to be authorized under the provisions of the Computer Fraud and Abuse Act, the Digital Millennium Copyright Act, and similar anti-hacking and anti-circumvention statutes. You are otherwise expected to comply with all applicable laws.
If we become aware that government authorities have initiated legal action against you for security research conducted in strict accordance with the terms of this policy, we will advise the applicable government authorities that we consider your actions to have been "authorized" hereunder.
Please note that this safe harbor policy will not apply to security activities performed in accordance with an executed, written agreement between you and ASSA ABLOY. The terms of any such agreement shall prevail in their entirety over the terms of this policy.
Expectations
- Make a good-faith effort to avoid harm to ASSA ABLOY Americas, our customers, and our end-users — including, but not limited to, privacy violations, destruction of data, and interruption or degradation of our services.
- Do not access or attempt to access ASSA ABLOY Americas offices, data centers, or user accounts.
- Do not test for spam, perform phishing, conduct social engineering, or intentionally cause denial of service issues for ASSA ABLOY Americas services.
- Do not access or attempt to access our customers' or end-users' offices, data centers, or user accounts, or attempt other forms of penetration testing without the direct, written approval of the system owner.
- Comply with all applicable laws and regulations. Do not disrupt or compromise any data that is not your own, or further exploit a confirmed vulnerability.
- If a vulnerability provides unintended access to data, limit the amount of data you access to the minimum required to demonstrate a proof of concept. After ASSA ABLOY Americas validates your report, properly dispose of all copies of the data. Promptly report your findings through our approved channels.
- If at any time you have concerns or are uncertain whether your security research is consistent with this policy, please inquire via HackerOne Support before going any further.