At Fox ESS, we take the security of our products, cloud platform, and services extremely seriously.
We are committed to working with the security community, customers, installers, and partners to identify and resolve potential vulnerabilities responsibly.
This page sets out our vulnerability management framework, including how to report a vulnerability, how we respond and handle reported issues, and how we disclose vulnerability information in compliance with applicable regulations. It also outlines what you can expect from us throughout the entire process.
Scope
This policy applies to Fox ESS products and services, including:
· Solar inverters, battery energy storage systems, and communication modules
· Fox Cloud services and associated backend infrastructure
· Fox ESS mobile applications
· APIs and web services
· Device firmware and associated software
How to Report a Vulnerability
If you believe you have discovered a security vulnerability in a Fox ESS product or service, please let us know
as soon as possible.
Email: security@fox-ess.com
When reporting, please include:
• A clear description of the issue
• Steps to reproduce
• Product model, firmware version, or platform affected
• Any supporting evidence (logs, screenshots, payloads, etc.)
• Your contact details (optional if you prefer anonymity)
We strongly recommend using PGP (Pretty Good Privacy) encryption for all communications sent to security@f ox-ess.com.
The Fox ESS Security Teams PGP public key is available below:
• Key ID: 8959FCFCBCF09435
• Fingerprint: C714 9ABF 7D5E C82F F6C7 16EA 8959 FCFC BCF0 9435
You can download the public key by clicking here: 8959FCFCBCF09435
You may download and use our vulnerability reporting template[insert template] when submitting a suspected vulnerability by email. Fox ESS will acknowledge received reports as soon as reasonably practicable and aims to provide an initial acknowledgement within 24 hours. Validation timelines may vary depending on the complexity, severity, reproducibility, and affected product.
Vulnerability Handling Pipeline
Our vulnerability handling pipeline includes the following steps:
• Vulnerability Receipt: Our Security and Engineering Teams regularly monitor designated vulnerability reporting channels, promptly review incoming submissions, and assign them for appropriate handling.
• Vulnerability Validation: We assess and validate each report, confirming its exploitability and potential impact. For technical severity assessment, Fox ESS uses the Common Vulnerability Scoring System (CVSS), an open industry standard maintained by the Forum of Incident Response and Security Teams (FIRST). We primarily use CVSS v3.1 for scoring and continuously evaluate the adoption of CVSS v4.0 as the framework evolves. CVSS Base Scores range from 0.0 to 10.0 and map to the following qualitative severity ratings:
The CVSS v3.1 metric groups include:
• Base Metrics ‒ Intrinsic qualities of a vulnerability (Attack Vector, Attack Complexity, Privileges Required, User Interaction, and impacts on Confidentiality, Integrity, and Availability).
• Temporal Metrics ‒ Characteristics of a vulnerability that may change over time, such as exploit code maturity and remediation level.
• Environmental Metrics ‒ Adjustments based on factors specific to a users environment, such as system criticality and security requirements.
For publicly disclosed vulnerabilities, Fox ESS may publish the applicable CVSS score and vector string to provide transparency regarding the severity assessment.
• Vulnerability Remediation: Fox ESS develops and implements appropriate corrective measures, which may include firmware updates, software patches, cloud-side fixes, configuration changes, temporary mitigations, or customer guidance. Remediation measures are tested and verified before release where practicable.
• Vulnerability Disclosure and Regulatory Reporting: Where required by applicable laws and regulations, Fox ESS reports qualifying vulnerabilities and security incidents to the relevant authorities within the prescribed timeframes. Fox ESS coordinates public disclosure where appropriate, taking into account remediation availability, customer security, exploitation risk, and applicable regulatory requirements.
• Vulnerability Closure and Continuous Improvement: We integrate customer feedback and internal reviews to continuously track, update, and enhance our vulnerability management processes.
Security Update Support
Fox ESS provides security updates for the full supported lifecycle of each product, up to the published end-of life (EOL) date.
Where warranted by the severity and impact of a vulnerability, Fox ESS may provide security updates beyond the published support period where technically feasible.
Contact
Fox ESS Security Team
Email: security@fox-ess.com
Address: No. 939, Jinhai Third Road New Airport Industry Area Longwan District, Wenzhou Zhejiang Province, China
Policy Versioning
Version: 1.0
Published: July 2026
The Fox ESS Security Team will update and publish revisions to this Vulnerability Disclosure and Handling Policy on this page as needed. Please refer to this page regularly for the latest version.