Nietzsche Enterprise Co., Ltd. (NHR)
This policy applies to NHR P02 and P08 series products and their supplied firmware. Customer-operated receiving systems, platforms and third-party services are outside its scope. Issues involving third-party services should also be reported to their respective providers.
Please report suspected vulnerabilities to our vulnerability reporting mailbox:
Include the product model, firmware version, issue description, reproduction steps, potential impact, relevant screenshots or logs, and a contact email address. Do not include passwords, private keys, SIM authentication secrets or unnecessary personal data. Contact us first to arrange the transfer of sensitive evidence.
We will acknowledge reports within 7 calendar days of receipt and assess their applicability and risk based on the information provided. We may contact the reporter for additional details.
While an issue remains unresolved, we will provide progress updates at least every 30 calendar days and communicate significant changes in the assessment or response plan. Updates will continue until resolution. If an issue is assessed as not applicable or not confirmed as a vulnerability, we will explain the reason for closing the case. Response measures and completion times depend on the individual assessment.
We will assess appropriate measures based on risk, actual product capabilities and feasible options, and provide risk-reduction guidance where needed. This policy does not imply remote firmware update capability or guarantee that every issue can be corrected through software.
Avoid unauthorized access, modification or deletion of data, disruption of normal operations, or misuse of vulnerabilities. This policy does not authorize testing. We welcome coordination on the timing and content of public disclosure to reduce the risk of misuse. Thank you for helping improve product security.
This section applies to NHR P02-NI and P08-NI configurations that do not provide user-operated or remote firmware updates after delivery. It does not extend to other models or versions with different update mechanisms. Customer-operated receiving systems, platforms and third-party services are outside the scope of this section.
The security support period is two (2) years from the shipment date of each unit. During this period, NHR accepts vulnerability reports, assesses security risks, provides appropriate response guidance and notifies affected customers when necessary. The shipment date can be checked against shipment documents. For assistance, contact service@nhriot.com.
These configurations do not provide user-operated firmware updates or remote firmware updates over BLE or NB-IoT after delivery. The Application does not provide a product function for receiving and writing firmware update files over NB-IoT or UART. The Bootloader provides no user-accessible or remotely initiated DFU update entry point. The S140 SoftDevice retained in the image and the NHR M06 firmware/TLS components likewise have no post-delivery user-operated or remote update procedure. Manufacturing-stage programming and controlled certificate provisioning do not constitute a post-delivery firmware update service.
If a vulnerability affects these components, including the Bootloader, NHR will assess mitigation or whole-unit replacement based on its actual impact. Where necessary, NHR will assist the deployer in stopping connections or deactivating the SIM. These measures interrupt remote data reporting and do not preserve the original connected service.
During the two-year support period, NHR maintains a purchasing channel for whole-unit replacements with the same specifications or a compatible alternative. Within 30 days of confirming that a product is affected, NHR will provide isolation/replacement arrangements, a quotation or an estimated delivery schedule. If delivery is unavailable, NHR will still provide temporary isolation measures and a written response plan within that period. This deadline is for providing arrangements or a plan, not a guarantee of remediation or delivery within 30 days.
Policy version: 1.4 | Last updated: 7 October 2026