- Top reward
- No cash rewards
- Top severity paid
- Critical
- Assets in scope
- 12
- Public CVEs
- 5
- Last change
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report on HackerOne
- Submit through the program page.
Rewards
What HackerOne lists as the payout for each severity.
This program does not pay cash rewards.
Scope
12 assets you may test.
Web 3
- bose.xx Critical No bounty
- btu.bose.com Critical No bounty
- support.bose.xx Critical No bounty
Wildcard domains 2
- *.bose.io Critical No bounty
- *.bose.xx Critical No bounty
Hardware and IoT 1
- Bose Automotive Critical No bounty
Products and areas 6
- Bose Credentials Critical No bounty
- Bose Hardware Critical No bounty
- Bose Source Code Critical No bounty
- McIntosh Critical No bounty
- Sonus Faber Critical No bounty
- Stream Unlimited Critical No bounty
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Bose (VDP) (via HackerOne)'s policy.
While testing
-
Please provide detailed reports with reproducible steps.
-
Submit one vulnerability per report unless you need to chain vulnerabilities to provide impact.
-
Only interact with accounts you own or with the explicit permission of the account holder.
Summarised with AI from the program policy on HackerOne, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 18 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
*.bose.io
-
Scope added
btu.bose.com
-
Scope added
Bose Automotive
-
Scope added
Stream Unlimited
-
Scope added
Sonus Faber
-
Scope added
McIntosh
-
Scope added
support.bose.xx
-
Scope added
*.bose.xx
-
Scope added
Bose Credentials
-
Scope added
Bose Hardware
-
Scope added
Bose Source Code
-
Scope added
bose.xx
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2018-12638 | An issue was discovered in the Bose Soundtouch app 18.1.4 for iOS. There is no frontend input validation of the device name. A malicious device name can execute JavaScript on the registered Bose User Account if a speaker has been connected to the app. | Medium 6.1 | 21 Mar 2019 |
| CVE-2017-17751 | Bose SoundTouch devices allows remote attackers to achieve remote control via a crafted web site that uses the WebSocket Protocol. | High 8.8 | 24 Mar 2018 |
| CVE-2017-17750 | Bose SoundTouch devices allow XSS via a crafted public playlist from Spotify. | Medium 5.4 | 24 Mar 2018 |
| CVE-2017-17749 | Bose SoundTouch devices allow XSS via crafted song data from a music service, as demonstrated by Pandora. | Medium 5.4 | 24 Mar 2018 |
| CVE-2017-6520 | The Multicast DNS (mDNS) responder used in BOSE Soundtouch 30 inadvertently responds to IPv4 unicast queries with source addresses that are not link-local, which allows remote attackers to cause a denial of service (traffic amplification) or obtain potentially sensitive information via port-5353 UDP packets. | Critical 9.1 | 1 May 2017 |
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Program Rules
- Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue may not be marked as triaged.
- Submit one vulnerability per report unless you need to chain vulnerabilities to provide impact.
- When duplicates occur, we only triage the first report received (provided that it can be fully reproduced).
- Only interact with accounts you own or with the explicit permission of the account holder.
Test Plan
Session Layer: HTTP Headers
Researchers should add headers to requests such as:
- “X-HackerOne-Research: [H1 username]”
Thank you for helping keep Bose and our users safe!