- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 2
- Public CVEs
- 1
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Replies within 3 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Response
-
Within 3 days
Our security department will confirm receipt within 3 business days of receiving your submission.
- Hall of fame
-
Yes
we will give public recognition and thanks in the officially published product or web service security advisories or on the "Hall of Fame" page to highlight your contributions.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
2 assets you may test, 2 excluded.
Domains 1
- benq.com
Products and areas 1
- all hardware, software, web applications, cloud services, and underlying infrastructure developed by our company
Out of scope (2)
- social engineering attacks targeting our company's employees
- Vulnerabilities requiring "Physical Access" to the system to trigger
Rules
What the policy asks of you, and the bug types it won't reward, quoted from BENQ's policy. "We" in these lines means the program, not this site.
While testing
-
Avoid Harm: Make every effort to avoid violating user privacy, degrading user experience, disrupting the operation of internal or external servers, and destroying any data or physical assets.
-
Strict Confidentiality: Please keep the details of identified potential vulnerabilities confidential until we release a patch or until the mutually agreed disclosure date arrives (Embargo period).
-
No Commercial Use: Strictly prohibit the application of any vulnerabilities or exploit programs (Exploits) for commercial or for-profit purposes.
-
Legal Compliance: Please ensure compliance with all applicable laws and regulations in your jurisdiction and where our company operates.
-
You are required to cooperate with any requests by BENQ for additional information, assistance, research, and you agree to coordinate disclosures of any vulnerability as noted herein.
Not accepted
-
Vulnerabilities requiring "Physical Access" to the system to trigger
-
social engineering attacks targeting our company's employees
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 12 Nov 2026. Last checked 3 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2021-37911 | The management interface of BenQ smart wireless conference projector does not properly control user's privilege. Attackers can access any system directory of this device through the interface and execute arbitrary commands if he enters the local subnetwork. | High 8.8 | 30 Aug 2021 |