Pentair
Vulnerability disclosure program on Self-hosted pentair.com
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 3
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Safe harbor
-
Full
If you make a good faith effort to comply with this Program during your security research, Pentair will consider your research to be authorized Pentair will work with you to understand and resolve the issue quickly, and Pentair will not recommend or pursue legal action related to your research.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
3 assets you may test, 10 excluded.
Hardware and IoT 1
- All current connected products (excluding the cloud connection and cloud storage)
Products and areas 2
- All mobile applications
- All websites
Out of scope (10)
- Attacks against Pentair infrastructure
- Attacks requiring physical access to a user's mobile device
- Network Provisioning errors
- Products and services no longer produced, maintained, or sold by Pentair, including outdated or unpatched applications, services, software, firmware
- Recent acquisitions for the first six (6) months after acquisition to give Pentair time to internally review and mitigate any issues
- Security bugs in third-party applications (e.g. java, plugins) or websites
- Third-party websites or services, including third party software incorporated in Pentair applications
- Vulnerabilities affecting users of outdated browsers or platforms
- Vulnerabilities which require a jailbroken or rooted mobile device
- Vulnerabilities within Pentair’s lab, staging environments or sandbox
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Pentair's policy. "We" in these lines means the program, not this site.
While testing
-
Notify Pentair as soon as possible after you discover a real or potential security vulnerability.
-
Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or manipulation of data.
-
Only use exploits to the extent necessary to confirm a vulnerability’s presence.
-
Do not use accounts that are not your own.
-
Provide us a reasonable amount of time to resolve the issue before you disclose it publicly.
-
Denial of Service (DoS) attacks against Pentair, its products, or any of its third-party providers;
-
Social engineering or phishing to solicit login passwords or credentials from Pentair employees, contractors, or third-parties;
-
Physical attacks against Pentair employees, offices, or data centers;
Not accepted
-
Bugs that simply cause an app to crash
-
Host header injections (unless you can show how they could lead to a data loss)
-
Self-XSS (User defined payload)
-
Login/logout CSRF
-
Use of a known-vulnerable library (without evidence of exploitability)
-
Previously reported vulnerabilities unless some additional information is reported in the subsequent Report
-
Violation of licenses or other restrictions applicable to any vendor's product
-
Vulnerabilities that present negligible security impact or are exploited to conduct a malicious attack against Pentair
-
System vulnerabilities irrelevant to security issues
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.