Product security

Scope

This page covers ETON-branded products with digital elements:

• DSP amplifiers of the PP series (ETON PP 4|8, ETON PP 10|12) with the optional Bluetooth module and RC panel accessories
• ETON Stealth 7.1 and ETON MINI 150.4 DSP
• ETON CORE D8
• the ETON Control Center software for Windows, macOS and Linux and the app for Android and iOS
• the firmware of these devices and the related update services on etondsp.app

Report a vulnerability

Have you found a possible security vulnerability in an ETON product? Please report it confidentially to our Product Security Incident Response Team (PSIRT).

This address is for product security reports and privacy questions. For product support, warranty claims or general questions please contact ETON service: eton-audio.com

What we need from you

• product and model (e.g. PP 10|12), serial number and, if known, the hardware revision (type plate)
• the device's firmware version (shown in ETON Control Center)
• the version of ETON Control Center and the operating system and device, if the software is affected
• a description of the vulnerability and its possible impact
• steps to reproduce and, if available, a proof (proof of concept, captures, screenshots)
• whether, to your knowledge, the vulnerability is already exploited or publicly known
• your contact details and whether you want to be named in an advisory

Coordinated disclosure

We follow coordinated vulnerability disclosure. We ask you to:

• keep information about the vulnerability confidential until a fix is available or we have agreed on a publication date together (as a rule no later than 90 days after our acknowledgement),
• exploit a vulnerability only as far as needed to prove it,
• not access, change or delete third-party data and not affect devices or vehicles that are not yours,
• not test in vehicles on public roads, because sudden changes of volume or sound can distract the driver,
• refrain from denial-of-service attacks, social engineering and attacks on our infrastructure and staff.

How we handle reports

These times are targets, not binding commitments.

Severity rating

We rate vulnerabilities with CVSS 4.0 and also weigh product-specific criteria, such as possible effects on connected speakers, on hearing and on attention while driving, and how close to the vehicle an attacker has to be.

Security updates

• ETON Control Center installs the firmware of PP amplifiers over USB. On connecting it downloads the newest matching firmware, backs up the settings first and restores them afterwards.
• Firmware updates for ETON Stealth, ETON MINI 150.4 DSP and ETON CORE D8 are available through ETON Control Center or ETON service.
• The desktop version of ETON Control Center checks for updates at start-up. Update packages are digitally signed and installed only after you confirm.
• Security updates are free of charge. Every security update stays available for at least ten years after its release or for the rest of the support period, whichever is longer.
• We mark security-relevant changes in the release notes on the download page.

Support periods

During the support period we handle vulnerabilities and provide security updates.

When a support period ends we announce it, where technically possible, in ETON Control Center.

Security advisories

Using the products securely

• Keep your device's firmware and ETON Control Center up to date.
• Download software and firmware only from etondsp.app or through the update function of ETON Control Center.
• With the Bluetooth module: pair the device only with your own phones and remove pairings you no longer need.
• Do not change sound settings while driving.
• Reset the device to factory settings and delete the Bluetooth pairings before you sell or pass it on.

security.txt

Our contact details for security reports are also available machine-readable under RFC 9116: /.well-known/security.txt