- Top reward
- $10,000
- Top severity paid
- Not published
- Assets in scope
- 166
- Public CVEs
- 9
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $10,000
- top reward, from $100.
- Report by email
- [email protected]
- No safe harbor
- No promise about legal action.
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Pays cash
-
Yes
Bounties may be awarded for reporting qualifying and in-scope vulnerabilities
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Reward range in US dollars. Self-hosted's own page has the details.
Scope
166 assets you may test, 81 excluded.
Wildcard domains 124
- *.079.ch
- *.adapt-solutions.ch
- *.ajila.com
- *.audiovideo-sa.ch
- *.axept.ch
- *.blue.ch
- *.bluecinema.ch
- *.bluenews.ch
- *.blue-plus.ch
- *.blueplus.ch
- *.bluewin.ch
- *.cablex.ch
- *.cablex-toolbox.ch
- *.conextrade.com
- *.crowdinsider.ch
- *.curabill.ch
- *.cura-med.ch
- *.digitalassessment.ch
- *.digital.deals
- *.digitalone.ch
- *.directories.ch
- *.directoriesdata.ch
- *.ealarm-safemode.ch
- *.ealarmstarter.ch
- *.e-directories.ch
- *.ellb.ch
- *.etv.ch
- *.eventcore.io
- *.eventict.ch
- *.glipac.ch
- *.globalipaction.ch
- *.hcard.ch
- *.h-net.ch
- *.intswisscom.com
- *.ip-plus.net
- *.itnetx.ch
- *.i-web.ch
- *.i-web-status.ch
- *.jlr-connect.ch
- *.jls.ch
- *.jls.digital
- *.kit.ag
- *.kitagcinemas.ch
- *.kitag.com
- *.kmudigital.ch
- *.labnet.ch
- *.local.ch
- *.localcities.ch
- *.localclubs.ch
- *.localina.com
- *.localreservation.ch
- *.localsearch-business.ch
- *.localsearch.ch
- *.localsearch-free.ch
- *.localsearch-hosting.ch
- *.localsearch.tech
- *.localsearchweb.ch
- *.mccip.ch
- *.medicalconnector.ch
- *.medicalexchange.ch
- *.medicalshare.ch
- *.mucc-services.ch
- *.multisource.ch
- *.multisourcepro.ch
- *.mycablex.ch
- *.mycloud.ch
- *.mycloudswisscom.ch
- *.mycommerce.shop
- *.mylocalina.ch
- *.owt.swiss
- *.pk-complan.ch
- *.projectmm.ch
- *.provisag.ch
- *.provis.ch
- *.public-directory.ch
- *.pwlan.ch
- *.renovero.ch
- *.sbcdc.ch
- *.scbs.ch
- *.scdag.net
- *.scsstatic.ch
- *.sctv.ch
- *.search.ch
- *.securepop.ch
- *.sinso.ch
- *.smeoffer.ch
- *.sospos.ch
- *.swisscloud.io
- *.swisscom.ai
- *.swisscom-alarm.ch
- *.swisscomcdn.ch
- *.swisscom.ch
- *.swisscomcloud.com
- *.swisscom.com
- *.swisscom-flaechen.ch
- *.swisscom-learningcenter.ch
- *.swisscom-mcc.ch
- *.swisscomras.ch
- *.swisscom-shop.ch
- *.swisscomstream.ch
- *.swisscom-tv.com
- *.swissdigicert.ch
- *.swisslist.ch
- *.swisstrustcert.ch
- *.swisstrustroom.ch
- *.swisstrustroom.com
- *.teldas.ch
- *.teleclub.ch
- *.teleclubsport.ch
- *.triamed.ch
- *.truvami.com
- *.truvuna.ch
- *.united-security-providers.ch
- *.u-s-p.ch
- *.veertly.ch
- *.veertly.de
- *.viaas.ch
- *.videoinsider.ch
- *.volvo-online.ch
- *.websheep.com
- *.webtiser.ch
- *.webtiser.com
- *.wingo.ch
- *.worklink.ch
Domains 23
- bgv.filecloud.mtfcloud.ch
- bugbounty.swisscom.ch
- cinetrade.ch
- contributing.md
- crowdinsider.ch
- filecloud.mtfcloud.ch
- ibion.ch
- i-web-status.ch
- jassfederal.ch
- lanexpert.ch
- numberportability.ch
- readme.md
- sbc-ticketing.ch
- secmail.swisscom.com
- status.mtfcloud.ch
- swisscom.ch
- swisscom-health.ch
- testsrv.numberportability.ch
- truvuna.ch
- vergleich.ch
- ws.numberportability.ch
- ws.testsrv.numberportability.ch
- zabbix.mtf.li
Source code 18
- https://github.com/security/advanced-security
- https://github.com/swisscom
- https://github.com/swisscom/bugbounty/blob/main/CONTRIBUTING.md
- https://github.com/swisscom/bugbounty/blob/main/README.md
- https://github.com/swisscom/bugbounty/blob/main/scope/README.md
- https://github.com/swisscom/bugbounty/commit/200ba18d541f5ef46078ff8a1798fab7dc8ea667
- https://github.com/swisscom/bugbounty/commit/20f6d76fca59a9766b549d3d6291767715fee8a0
- https://github.com/swisscom/bugbounty/commit/2b4c69490eccb53639ffb36a882ac31b69b6fafa
- https://github.com/swisscom/bugbounty/commit/4cef0f95a7cb8d4aecfde6621886912fbae0487e
- https://github.com/swisscom/bugbounty/commit/52a7c245a5fd541e0cc35a5ec0553c2133ec4396
- https://github.com/swisscom/bugbounty/commit/a1361af4962dfb64dfac478ca7278cfd4e36341a
- https://github.com/swisscom/bugbounty/commit/a1c600a4893436f8ad64187057824c0d549ac005
- https://github.com/swisscom/bugbounty/commit/b85f9ab5c7062cf669e88b9e218aa7aa8ec688f8
- https://github.com/swisscom/bugbounty/commit/b9a933659257f22e199fe07d117f303c1edc0bb2
- https://github.com/swisscom/bugbounty/commit/d16134166f714b587a270995f978ba52411a1c81
- https://github.com/swisscom/bugbounty/commit/ed9008fee73e45d4e81c331ef6d1129cebd3bab2
- https://github.com/swisscom/bugbounty/commit/f453a1c9a75cff4149656119f97e9fcbf04495ed
- https://github.com/swisscom/bugbounty/tree/main/scope
APIs 1
- api.mailarchiver.mtfcloud.ch
Out of scope (81)
- 193.247.168.0/21
- amag.supportcenter.autosense-cloud.com
- autodiscover.mtf-ti.ch
- confluence.camptocamp.com
- fiberdoc.cablex.ch
- grafana.rk8s.94946.mtfcloud.ch
- helion.supportcenter-dev.autosense-cloud.com
- jira.camptocamp.com
- keycloak.rk8s.94946.mtfcloud.ch
- mail.mtf-ti.ch
- outlook.mtf-ti.ch
- prometheus.rk8s.94946.mtfcloud.ch
- route-server-bi.ce.ip-plus.net
- route-server.ce.ip-plus.net
- shop.m-budget.migros.ch
- swisscom.ecommerce-benchmark.com
- swisscom.shirthouse.ch
- swisscomsolutions.vpch.ch
- webapp.rk8s.94957.mtfcloud.ch
- https://github.com/swisscom/bugbounty/blob/main/scope/inscope.txt
- https://github.com/swisscom/bugbounty/blob/main/scope/outofscope.txt
- *.7layers.it
- *.admeira.ch
- *.adunit.ch
- *.adunit.tech
- *.autosense.ch
- *.autosense-cloud.com
- *.camptocamp.ch
- *.camptocamp.com
- *.camptocamp.de
- *.camptocamp.fr
- *.camptocamp.net
- *.camptocamp.org
- *.coopmobile.ch
- *.custodigit.com
- *.cust.swisscom.ch
- *.cust.swisscom.net
- *.cust.wingo.ch
- *.datasport.ch
- *.energie-klimapioniere.ch
- *.fastweb.it
- *.getkickbox.com
- *.homepagetool.ch
- *.hospitality.swisscom.com
- *.hostcenter.com
- *.internet-box.ch
- *.klimapioniere.ch
- *.local.fr
- *.mila.cloud
- *.mila.com
- *.mtfcloud.ch
- *.mtf-ti.ch
- *.mystrom.ch
- *.oniva.events
- *.parato.ch
- *.paybillag.com
- *.pcwtag.itservices.ch
- *.pub.wingo.ch
- *.rnas-dyn.bluewin.ch
- *.sbc-nms.ch
- *.sbctv.ch
- *.scene7.com
- *.sfsnet.ch
- *.sitefree.ch
- *.swisscom-printshop.ch
- *.swisscom-umfrage.ch
- *.tiko.at
- *.tiko.ch
- *.tiko.de
- *.tiko.energy
- *.tiko-energy.ch
- *.tiko-energy.com
- *.tikoenergy.com
- *.tiko.fr
- *.tiko.info
- *.tiko.net
- *.tiko.services
- *.tiko.swiss
- *.tiko.uk
- *.vodafone.it
- *.zoon.ch
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2020-16134 | An issue was discovered on Swisscom Internet Box 2, Internet Box Standard, Internet Box Plus prior to 10.04.38, Internet Box 3 prior to 11.01.20, and Internet Box light prior to 08.06.06. Given the (user-configurable) credentials for the local Web interface or physical access to a device's plus or reset button, an attacker can create a user with elevated privileges on the Sysbus-API. This can then | High 8.0 | 4 Aug 2020 |
| CVE-2019-19940 | Incorrect input sanitation in text-oriented user interfaces (telnet, ssh) in Swisscom Centro Grande before 6.16.12 allows remote authenticated users to execute arbitrary commands via command injection. | High 7.2 | 16 Mar 2020 |
| CVE-2019-19941 | Missing hostname validation in Swisscom Centro Grande before 6.16.12 allows a remote attacker to inject its local IP address as a domain entry in the DNS service of the router via crafted hostnames in DHCP requests, causing XSS. | Medium 5.4 | 16 Mar 2020 |
| CVE-2019-19942 | Missing output sanitation in Swisscom Centro Grande Centro Grande before 6.16.12, Centro Business 1.0 (ADB) before 7.10.18, and Centro Business 2.0 before 8.02.04 allows a remote attacker to perform DNS spoofing against the web interface via crafted hostnames in DHCP requests. | High 7.5 | 16 Mar 2020 |
| CVE-2018-16596 | A stack-based buffer overflow in the LAN UPnP service running on UDP port 1900 of Swisscom Internet-Box (2, Standard, and Plus) prior to v09.04.00 and Internet-Box light prior to v08.05.02 allows remote code execution. No authentication is required to exploit this vulnerability. Sending a simple UDP packet to port 1900 allows an attacker to execute code on a remote device. However, this is only po | High 7.5 | 17 Dec 2018 |
| CVE-2018-16225 | The QBee MultiSensor Camera through 4.16.4 accepts unencrypted network traffic from clients (such as the QBee Cam application through 1.0.5 for Android and the Swisscom Home application up to 10.7.2 for Android), which results in an attacker being able to reuse cookies to bypass authentication and disable the camera. | Medium 6.5 | 18 Sep 2018 |
| CVE-2018-6765 | Swisscom MySwisscomAssistant 2.17.1.1065 contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system. This vulnerability exists due to the way .dll files are loaded. It allows an attacker to load a .dll of the attacker's choosing that could execute arbitrary code without the user's knowledge. The specific flaw exists within the han | High 7.8 | 27 Mar 2018 |
| CVE-2018-6766 | Swisscom TVMediaHelper 1.1.0.50 contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system. This vulnerability exists due to the way .dll files are loaded. It allows an attacker to load a .dll of the attacker's choosing that could execute arbitrary code without the user's knowledge. The specific flaw exists within the handling of | High 7.8 | 27 Mar 2018 |
| CVE-2015-1188 | The certificate verification functions in the HNDS service in Swisscom Centro Grande (ADB) DSL routers with firmware before 6.14.00 allows remote attackers to access the management functions via unknown vectors. | High 7.5 | 20 May 2015 |