Connected product security failure after sale
Preserve the report, identify affected hardware and software versions, and assess customer exposure. Investigate possible PSTI failures, escalate to the manufacturer and check your notification duties without waiting for a promised patch. Factory records can be gathered by the China-based staff of Cambridge China Bridge.
Open an incident and establish what failed
Appoint an incident lead and preserve the original report, screenshots, logs and correspondence. Record what the reporter observed, the conditions needed to reproduce it and whether customer devices appear to have been exploited. Keep sensitive technical details in a controlled incident file. Ask a competent security specialist to assess exposure and immediate protective measures.
Assess the technical vulnerability and the possible compliance failure separately. Compare the evidence with the security requirements and documents covered in our PSTI importing guide. Investigate reported potential compliance failures after supply and confirm your obligations with OPSS. Where you know or believe the manufacturer has failed to comply, hold further supply of the affected product while seeking advice.
Map affected versions to goods already sold
Build a version register linking the sales model to hardware revision, installed firmware, app version, cloud service, production batch and shipment. Record both the factory-installed firmware and subsequent updates. Ask the factory and software provider which other models share the affected code or component. A different case or brand label is not evidence of different software.
Connect that register to warehouse, marketplace, distributor and customer records. Ask the manufacturer for a written explanation of affected and unaffected versions, supported by test results. Mark missing version information as unresolved. Keep stock awaiting dispatch and devices already with customers visible separately, because updating warehouse stock does not protect customers who already bought it.
Escalate to the people who can deliver a fix
Send the manufacturer a controlled incident pack containing product identifiers, affected versions, the report and reproduction evidence. Ask for a named security contact, root cause, affected scope, interim protection, proposed remedy and update plan. Include the firmware, app and cloud providers where relevant. Record contact attempts and unanswered requests.
Ask who can sign and release the update, maintain the supporting service and reach installed devices. Request evidence that the proposed fix works on customer configurations, including devices that missed earlier updates. Keep commercial recovery separate from customer protection; our faulty goods and claims guide covers supplier discussions.
Check importer notification duties promptly
For a manufacturer’s security compliance failure, contact the manufacturer promptly and confirm the applicable contact requirements with OPSS. The importer normally must notify the enforcement authority and supplied distributors as soon as possible after contact or attempted contact. OPSS is the PSTI enforcement authority. Do not wait for the manufacturer to answer or finish a patch. Check with OPSS whether a statutory exception applies where another relevant person has already notified you, and what confirmation is needed about notification to the authority.
Use the official contact details in the sources to raise suspected non-compliance with OPSS. Prepare the failure description, affected versions, known risks, contact history and corrective action evidence, marking unknowns clearly. Ask for advice on the applicable route if the failure concerns your own importer obligations, and on any customer notification conditions. Keep dated copies of submissions and responses.
Working out your own order? Send us the product on WhatsApp and we reply the same working day: WhatsApp us
Verify the remedy and track unresolved devices
Assess whether an update, configuration change, service restriction, replacement or recall can address the exposure. Test the remedy on affected configurations and check installation failure, recovery and normal operation. Explain customer actions in plain language, including how to identify the product and confirm the updated version. Where physical recovery is needed, use our imported product recall guide.
Track successful installations separately from messages sent, downloads and customer replies. Keep unreachable customers, offline devices and failed updates open for review. Confirm with OPSS how long importer investigation records must be retained. Keep scope decisions, factory findings, verification results and unresolved risks together, and require evidence before restarting affected supply or treating the incident as closed.
Frequently asked questions
Does every security vulnerability mean a PSTI failure?
Assess the vulnerability and compliance separately. Identify the relevant security requirement, compare the evidence and investigate a reported potential failure. A factory assurance does not replace that assessment.
Can I wait for the Chinese factory to release a patch?
Do not wait for a patch before checking notification duties. For a manufacturer’s compliance failure, notification normally follows contact or attempted contact as soon as possible, subject to statutory exceptions.
What if I cannot identify affected firmware versions?
Reconstruct versions from factory release records, retained samples and customer devices. Mark gaps as unresolved and ask a security specialist whether a wider affected scope is needed.
How do I know a security update has fixed the problem?
Verify the fix on affected configurations and confirm installation on customer devices. A released patch or download count does not establish that installed products are protected.