- Top reward
- $2,000
- Top severity paid
- Critical
- Assets in scope
- 86
- Public CVEs
- 36
- Last change
At a glance
What to know before you start testing.
- Pays up to $2,000
- for critical bugs.
- Report through their form
- hackerone.com/962d7e24-cb51-4f8a-9edc-5ed966857d44/embedded_submissions/new
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Replies within 1 day
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What HackerOne lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$2,000 |
| High |
|
$1,000 |
| Medium |
|
$500 |
| Low |
|
$175 |
- Response
-
Within 1 days
Time to first response (from report submit) - 1 business day
- Safe harbor
-
Full
Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
86 assets you may test, 7 excluded.
Web 33
- accounts.logi.com Critical
- alert.logitech.com High No bounty
- buy.logitech.com Critical No bounty
- circle.logi.com Critical
- community.logitech.com Critical No bounty
- external.logitech.com Critical No bounty
- feedback.logitech.com Critical No bounty
- gaming.logicool.co.jp Critical
- https://www.logitech.com/blog Critical No bounty
- id.logi.com Critical
- jira.logitech.com Critical No bounty
- logilife.logitech.com Critical No bounty
- logiq.logitech.io Critical
- logitechgchallenge.com Critical No bounty
- logitechg.com.cn Critical
- logitech.zendesk.com Critical No bounty
- maintenance.logitech.com Critical No bounty
- outagehistory.logitech.com Critical No bounty
- outage.logitech.com Critical No bounty
- partner.logitech.com Critical No bounty
- select.logitech.com Critical No bounty
- support.logi.com Critical No bounty
- sync.logitech.com Critical
- www.astrogaming.com Critical
- www.jaybirdsport.com Critical No bounty
- www.logicool.co.jp Critical
- www.logitechclub.com Critical No bounty
- www.logitech.com Critical
- www.logitech.com.cn Critical
- www.logitechg.com Critical
- www.logitech-partner.com Critical No bounty
- www.logitechstore.com.br Critical No bounty
- www.ultimateears.com Critical
Wildcard domains 25
- *.cognitiveperformer.com Medium No bounty
- *.crossclip.com Critical No bounty
- *.harmonyremote.com Critical No bounty
- *.logi.com Critical No bounty
- *.logicool.co.jp Medium No bounty
- *.logitechauthorization.com Critical No bounty
- *.logitech-channel-marketing.com Critical No bounty
- *.logitech.com Critical No bounty
- *.logitechg.com* Critical No bounty
- *.logitech.io Critical No bounty
- *.logitechmusic.com Critical No bounty
- *.lucra.live Critical No bounty
- *.lukwerks.com Medium No bounty
- *.melonapp.com Critical No bounty
- *.mevo.com Critical No bounty
- *.myharmony.com Critical No bounty
- *.mysqueezebox.com Critical No bounty
- *.oslo.io Critical No bounty
- *.slimdevices.com Critical No bounty
- *.streamlabscharity.com Critical No bounty
- *.streamlabs.com Critical
- *.uesmartradio.com Critical No bounty
- *.ultimateearsuniversity.com Critical No bounty
- *vc.logitech.com Critical
- *.wlo.link Critical No bounty
Desktop and binaries 9
- G Hub High
- Harmony Remote Software Critical No bounty
- Logi Options+ PC/MAC High
- Logitech MIXLINE Critical
- Logitech Options PC/MAC High No bounty
- Logitech Sync Critical
- Logi Tune PC/MAC High
- Other Logitech Desktop and Mobile Application Critical No bounty
- Streamlabs Desktop Application PC/MAC Critical
Hardware and IoT 8
- Circle Cameras Critical
- Harmony Remotes High No bounty
- Logitech Mice & Keyboards High
- Other Logitech Hardware/IoT Critical No bounty
- Presentation Remotes High
- Ultimate Ears Speakers Medium
- USB Unifying and LightSpeed Receivers Critical
- Video Conferencing Products Critical
Android apps 5
- com.logitech.circle Critical
- com.logitech.logue High
- com.logitech.ueboom Critical
- com.streamlabs Critical
- com.streamlabs.slobsrc Critical
iOS apps 5
- 1018340690 Critical
- 1294578643 Critical
- 1456293789 High
- 1476615877 Critical
- 632344648 Critical
Products and areas 1
- Scope Questions: Items not explicitly listed here Critical No bounty
Out of scope (7)
- Logitech Capture
- Logitech Alert Cameras
- Squeezebox Products
- *.saitek.com
- *.saitekforum.com
- *.saitek-fr.com
- *.wilife.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Logitech (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Please understand that we cannot work with anyone who violates applicable laws or regulations, attempts to exploit a security issue or access other users' data - in other words, violate this policy.
-
You agree that you will not disclose vulnerability information reported to Logitech to any other third party, until granted permission to do so from Logitech.
-
You must disclose all possible ways to exploit an issue in your original report.
-
Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward.
-
Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
-
Social engineering (e.g. phishing, vishing, smishing) is prohibited.
-
Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.
Not accepted
-
Denial of service attacks
-
Password cracking attempts, including but not limited to: brute forcing, rainbow attacks, word list substitution, pattern checking
-
Clickjacking on pages with no sensitive actions
-
Attacks requiring takeover of the email or social account authenticating the victim account.
-
Tab-nabbing on non-user provided links (reports accepted, but not bounty eligible)
-
Unauthenticated/logout/login CSRF
-
Attacks requiring MITM or physical access to a user's device
-
Previously known vulnerable libraries without a working Proof of Concept
-
Comma Separated Values (CSV) injection without demonstrating a vulnerability
-
Missing best practices in SSL/TLS configuration.
-
Social engineering attacks (including phishing, vishing, smishing)
-
Software version disclosure
-
Issues requiring direct physical access to hardware (with the exception of hardware vulnerabilities)
-
Flaws affecting out-of-date browsers and plugins
-
Email enumeration / account oracles
-
CSP Policy Weaknesses
-
Email Spoofing
-
Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
Logitech Capture (out of scope)
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2024-8258 | Improper Control of Generation of Code ('Code Injection') in Electron Fuses in Logitech Options Plus version 1.60.496306 on macOS allows attackers to execute arbitrary code via insecure Electron Fuses configuration. | Low 2.0 | 10 Sep 2024 |
| CVE-2024-8011 | Logitech Options+ on MacOS prior 1.72 allows a local attacker to inject dynamic library within Options+ runtime and abuse permissions granted by the user to Options+ such as Camera. | Low 2.0 | 25 Aug 2024 |
| CVE-2024-2537 | Improper Control of Dynamically-Managed Code Resources vulnerability in Logitech Logi Tune on MacOS allows Local Code Inclusion. | Medium 4.4 | 15 Mar 2024 |
| CVE-2022-36263 | StreamLabs Desktop Application 1.9.0 is vulnerable to Incorrect Access Control via obs64.exe. An attacker can execute arbitrary code via a crafted .exe file. | High 7.3 | 19 Aug 2022 |
| CVE-2022-0916 | An issue was discovered in Logitech Options. The OAuth 2.0 state parameter was not properly validated. This leaves applications vulnerable to CSRF attacks during authentication and authorization operations. | High 8.4 | 3 May 2022 |
| CVE-2022-0915 | There is a Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability in Logitech Sync for Windows prior to 2.4.574. Successful exploitation of these vulnerabilities may escalate the permission to the system user. | Medium 6.0 | 12 Apr 2022 |
| CVE-2021-38547 | Logitech Z120 and S120 speakers through 2021-08-09 allow remote attackers to recover speech signals from an LED on the device, via a telescope and an electro-optical sensor, aka a "Glowworm" attack. The power indicator LED of the speakers is connected directly to the power line, as a result, the intensity of a device's power indicator LED is correlative to the power consumption. The sound played b | Medium 5.9 | 11 Aug 2021 |
| CVE-2021-20636 | Cross-site request forgery (CSRF) vulnerability in LOGITEC LAN-W300N/PR5B allows remote attackers to hijack the authentication of administrators via a specially crafted URL. As a result, unintended operations to the device such as changes of the device settings may be conducted. | Medium 6.5 | 12 Feb 2021 |
| CVE-2021-20637 | Improper check or handling of exceptional conditions in LOGITEC LAN-W300N/PR5B allows a remote attacker to cause a denial-of-service (DoS) condition by sending a specially crafted URL. | Medium 6.5 | 12 Feb 2021 |
| CVE-2021-20638 | LOGITEC LAN-W300N/PGRB allows an attacker with administrative privilege to execute arbitrary OS commands via unspecified vectors. | Medium 6.8 | 12 Feb 2021 |
| CVE-2021-20639 | LOGITEC LAN-W300N/PGRB allows an attacker with administrative privilege to execute arbitrary OS commands via unspecified vectors. | Medium 6.8 | 12 Feb 2021 |
| CVE-2021-20640 | Buffer overflow vulnerability in LOGITEC LAN-W300N/PGRB allows an attacker with administrative privilege to execute an arbitrary OS command via unspecified vectors. | Medium 6.8 | 12 Feb 2021 |
| CVE-2021-20641 | Cross-site request forgery (CSRF) vulnerability in LOGITEC LAN-W300N/RS allows remote attackers to hijack the authentication of administrators via a specially crafted URL. As a result, unintended operations to the device such as changes of the device settings may be conducted. | Medium 6.5 | 12 Feb 2021 |
| CVE-2021-20642 | Improper check or handling of exceptional conditions in LOGITEC LAN-W300N/RS allows a remote attacker to cause a denial-of-service (DoS) condition by sending a specially crafted URL. | Medium 6.5 | 12 Feb 2021 |
| CVE-2021-20635 | Improper restriction of excessive authentication attempts in LOGITEC LAN-WH450N/GR allows an attacker in the wireless range of the device to recover PIN and access the network. | Medium 6.5 | 12 Feb 2021 |
| CVE-2016-10761 | Logitech Unifying devices before 2016-02-26 allow keystroke injection, bypassing encryption, aka MouseJack. | Medium 6.5 | 29 Jun 2019 |
| CVE-2019-13052 | Logitech Unifying devices allow live decryption if the pairing of a keyboard to a receiver is sniffed. | Medium 6.5 | 29 Jun 2019 |
| CVE-2019-13053 | Logitech Unifying devices allow keystroke injection, bypassing encryption. The attacker must press a "magic" key combination while sniffing cryptographic data from a Radio Frequency transmission. NOTE: this issue exists because of an incomplete fix for CVE-2016-10761. | Medium 6.5 | 29 Jun 2019 |
| CVE-2019-13054 | The Logitech R500 presentation clicker allows attackers to determine the AES key, leading to keystroke injection. On Windows, any text may be injected by using ALT+NUMPAD input to bypass the restriction on the characters A through Z. | Medium 6.5 | 29 Jun 2019 |
| CVE-2019-13055 | Certain Logitech Unifying devices allow attackers to dump AES keys and addresses, leading to the capability of live decryption of Radio Frequency transmissions, as demonstrated by an attack against a Logitech K360 keyboard. | Medium 6.5 | 29 Jun 2019 |
| CVE-2019-12506 | Due to unencrypted and unauthenticated data communication, the wireless presenter Logitech R700 Laser Presentation Remote R-R0010 is prone to keystroke injection attacks. Thus, an attacker is able to send arbitrary keystrokes to a victim's computer system, e.g., to install malware when the target system is unattended. In this way, an attacker can remotely take control over the victim's computer th | High 8.8 | 7 Jun 2019 |
| CVE-2018-15720 | Logitech Harmony Hub before version 4.15.206 contained two hard-coded accounts in the XMPP server that gave remote users access to the local API. | Critical 9.8 | 20 Dec 2018 |
| CVE-2018-15721 | The XMPP server in Logitech Harmony Hub before version 4.15.206 is vulnerable to authentication bypass via a crafted XMPP request. Remote attackers can use this vulnerability to gain access to the local API. | Critical 9.8 | 20 Dec 2018 |
| CVE-2018-15722 | The Logitech Harmony Hub before version 4.15.206 is vulnerable to OS command injection via the time update request. A remote server or man in the middle can inject OS commands with a properly formatted response. | High 8.1 | 20 Dec 2018 |
| CVE-2018-15723 | The Logitech Harmony Hub before version 4.15.206 is vulnerable to application level command injection via crafted HTTP request. An unauthenticated remote attacker can leverage this vulnerability to execute application defined commands (e.g. harmony.system?systeminfo). | Critical 9.8 | 20 Dec 2018 |
| CVE-2018-0620 | Untrusted search path vulnerability in LOGICOOL Game Software versions before 8.87.116 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. | High 7.8 | 26 Jul 2018 |
| CVE-2018-0621 | Untrusted search path vulnerability in LOGICOOL CONNECTION UTILITY SOFTWARE versions before 2.30.9 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. | High 7.8 | 26 Jul 2018 |
| CVE-2017-16567 | Persistent Cross-Site Scripting (XSS) vulnerability in Logitech Media Server 7.9.0, affecting the "Favorites" feature. This vulnerability allows remote attackers to inject and permanently store malicious JavaScript payloads, which are executed when users access the affected functionality. Exploitation of this vulnerability can lead to Session Hijacking and Credential Theft, Execution of unauthoriz | Medium 5.4 | 10 Nov 2017 |
| CVE-2017-16568 | Persistent Cross-Site Scripting (XSS) vulnerability in Logitech Media Server 7.9.0, affecting the "Radio" functionality. This vulnerability allows attackers to inject malicious JavaScript payloads, which become permanently stored on the server and execute when a user plays the compromised radio stream. Exploitation of this vulnerability can lead to Session hijacking and unauthorized access, Persis | Medium 5.4 | 10 Nov 2017 |
| CVE-2017-15687 | DOM Based Cross Site Scripting (XSS) exists in Logitech Media Server 7.7.1, 7.7.2, 7.7.3, 7.7.5, 7.7.6, 7.9.0, and 7.9.1 via a crafted URI. | Medium 6.1 | 23 Oct 2017 |
| CVE-2016-6257 | The firmware in Lenovo Ultraslim dongles, as used with Lenovo Liteon SK-8861, Ultraslim Wireless, and Silver Silk keyboards and Liteon ZTM600 and Ultraslim Wireless mice, does not enforce incrementing AES counters, which allows remote attackers to inject encrypted keyboard input into the system by leveraging proximity to the dongle, aka a "KeyJack injection attack." | Medium 6.5 | 2 Aug 2016 |
| CVE-2012-1250 | Logitec LAN-W300N/R routers with firmware before 2.27 do not properly restrict login access, which allows remote attackers to obtain administrative privileges and modify settings via vectors related to PPPoE authentication. | High 10.0 | 4 Jun 2012 |
| CVE-2008-0956 | Multiple stack-based buffer overflows in the BackWeb Lite Install Runner ActiveX control in the BackWeb Web Package ActiveX object in LiteInstActivator.dll in BackWeb before 8.1.1.87, as used in Logitech Desktop Manager (LDM) before 2.56, allow remote attackers to execute arbitrary code via unspecified vectors. | High 9.3 | 12 Jun 2008 |
| CVE-2007-2918 | Multiple stack-based buffer overflows in ActiveX controls (1) VibeC in (a) vibecontrol.dll, (2) CallManager and (3) ViewerClient in (b) StarClient.dll, (4) ComLink in (c) uicomlink.dll, and (5) WebCamXMP in (d) wcamxmp.dll in Logitech VideoCall allow remote attackers to cause a denial of service (browser crash) and execute arbitrary code via unspecified vectors. | Medium 6.8 | 1 Jun 2007 |
| CVE-2002-1722 | Logitech iTouch keyboards allows attackers with physical access to the system to bypass the screen locking function and execute user-defined commands that have been assigned to a button. | Medium 4.6 | 31 Dec 2002 |
| CVE-2001-0737 | A long 'synch' delay in Logitech wireless mice and keyboard receivers allows a remote attacker to hijack connections via a man-in-the-middle attack. | High 7.5 | 18 Oct 2001 |
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Welcome to Logitech's Vulnerability Disclosure and Bug Bounty Program!
Here at Logitech we are committed to providing secure products and services to our customers. If you believe you have discovered a potential security vulnerability with any of the in-scope Logitech systems, products and/or services, we look forward to receiving your submission, and appreciate your help in disclosing the issue to us responsibly.
This program is dedicated to suspected security issues that may affect Logitech customers, systems, products and/or services. If you're having issues related to your Logitech product or a Logitech-related account, then please visit our Support Center.
Logitech looks forward to working with the security community to find security vulnerabilities in order to keep our business and customers safe.
Reports
- Please submit a detailed description of the issue, and the steps required to reproduce what you have observed. In doing so, please make every attempt possible to protect our customers' privacy, data confidentiality, and integrity - we very much value your assistance in preserving those.
- Please understand that we cannot work with anyone who violates applicable laws or regulations, attempts to exploit a security issue or access other users' data - in other words, violate this policy.
SLA
Upon receipt of your report, we promise to review and address any security issues in a timely manner and to communicate with you during our investigation and upon resolution. Logitech will make a best effort to meet the following SLAs for hackers participating in our program:
- Time to first response (from report submit) - 1 business day
- Time to triage (from first response) - 1 business day
- Time to bounty (from triage) - 10 business days
We’ll try to keep you informed about our progress if the process remains ongoing, via a quarterly update.
Disclosure Policy
-
We ask the security research community to give us a reasonable opportunity to correct a vulnerability before publicly disclosing it. Please submit a detailed description of the issue and the steps required to reproduce what you have observed. In doing so, please make every attempt possible to protect our customers' privacy, data confidentiality, and integrity - we very much value your assistance in preserving those. Please understand that we cannot work with anyone who violates applicable laws or regulations, attempts to exploit a security issue or access other users' data - in other words, violate this policy.
-
Our customers' privacy, data confidentiality, and integrity is crucial at Logitech. You agree that you will not disclose vulnerability information reported to Logitech to any other third party, until granted permission to do so from Logitech. We endeavor to grant such permission within two to four weeks from the release of the fix that addresses the discovered vulnerability.
-
Follow HackerOne's disclosure guidelines.
Program Rules
- Bounties are issued solely at the discretion of Logitech.
- Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.
- You must disclose all possible ways to exploit an issue in your original report. Logitech will not issue a bounty, follow-on bounty, or bonus if we believe you are abusing the report system by not providing complete information in your initial report.
- Please provide detailed reports with reproducible steps. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward. This usually requires a working proof-of-concept typically in the form of a clickable link that we can verify. Videos or screenshots are not considered definitive proof.
- Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
- When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).
- Social engineering (e.g. phishing, vishing, smishing) is prohibited.
- Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.
#Out of scope vulnerabilities When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:
- Denial of service attacks
- Password cracking attempts, including but not limited to: brute forcing, rainbow attacks, word list substitution, pattern checking
- Clickjacking on pages with no sensitive actions
- Attacks requiring takeover of the email or social account authenticating the victim account.
- Tab-nabbing on non-user provided links (reports accepted, but not bounty eligible)
- Unauthenticated/logout/login CSRF
- Attacks requiring MITM or physical access to a user's device
- Previously known vulnerable libraries without a working Proof of Concept
- Comma Separated Values (CSV) injection without demonstrating a vulnerability
- Missing best practices in SSL/TLS configuration.
- Social engineering attacks (including phishing, vishing, smishing)
- Software version disclosure
- Issues requiring direct physical access to hardware (with the exception of hardware vulnerabilities)
- Flaws affecting out-of-date browsers and plugins
- Email enumeration / account oracles
- CSP Policy Weaknesses
- Email Spoofing
- Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
- Installer based DLL or EXE side-load attacks must involve a privilege escalation and be functional without requiring repackaging inside of a container format (such as zip or 7z). If they don't meet this requirement, reports will be closed as informative.
- Any vulnerabilities identified in previous versions of our assets that are no longer supported are considered out-of-scope, even if the vulnerability is still exploitable in those versions. It is the researcher’s responsibility to stay updated on version releases.
Bounties
For Bounty eligible assets, Logitech's default policy is to award the bounty after a Logitech team member has confirmed the issue during the Triage process. We generally won't wait to award a bounty until the item is fixed as some products have long lead times in deploying fixes. However, we may make an exception to this policy on a report-by-report basis. Bounties are only awarded for actual security or privacy impacting reports.
Safe Harbor
Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you. If legal action is initiated by a third party against you in connection with activities conducted under this policy, we will take steps to make it known that your actions were conducted in compliance with this policy.
Thank you for helping keep Logitech and our customers safe!