{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T06:59:16Z","timestamp":1782975556922,"version":"3.54.5"},"reference-count":63,"publisher":"IEEE","license":[{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,5,18]],"date-time":"2026-05-18T00:00:00Z","timestamp":1779062400000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026,5,18]]},"DOI":"10.1109\/sp63933.2026.00180","type":"proceedings-article","created":{"date-parts":[[2026,7,1]],"date-time":"2026-07-01T19:34:20Z","timestamp":1782934460000},"page":"1-18","source":"Crossref","is-referenced-by-count":0,"title":["Responsible Disclosure is a Two-Way Street: Empirically Measuring the Responsible Disclosure Contract in the Firmware Ecosystem"],"prefix":"10.1109","author":[{"given":"Hui Jun","family":"Tay","sequence":"first","affiliation":[{"name":"Arizona State University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Souradip","family":"Nath","sequence":"additional","affiliation":[{"name":"Arizona State University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Arvind S","family":"Raj","sequence":"additional","affiliation":[{"name":"Arizona State University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Abhay","family":"Bhat","sequence":"additional","affiliation":[{"name":"Arizona State University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ishan","family":"Bansal","sequence":"additional","affiliation":[{"name":"Arizona State University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Audrey","family":"Dutcher","sequence":"additional","affiliation":[{"name":"Arizona State University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Moritz","family":"Schloegel","sequence":"additional","affiliation":[{"name":"CISPA Helmholtz Center for Information Security"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Adam","family":"Doup\u00e9","sequence":"additional","affiliation":[{"name":"Arizona State University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Tiffany","family":"Bao","sequence":"additional","affiliation":[{"name":"Arizona State University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yan","family":"Shoshitaishvili","sequence":"additional","affiliation":[{"name":"Arizona State University"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ruoyu","family":"Wang","sequence":"additional","affiliation":[{"name":"Arizona State University"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","volume-title":"Call for Papers","year":"2025"},{"key":"ref2","volume-title":"Everything Old Is New Again: Legal Restrictions on Vulnerability Disclosure on Bug Bounty Platforms","author":"Albert","year":"2025"},{"key":"ref3","year":"2025","journal-title":"Amazon.com"},{"key":"ref4","doi-asserted-by":"publisher","DOI":"10.5555\/3241189.3241275"},{"key":"ref5","year":"2025","journal-title":"ASUS End-of-Life Product List"},{"key":"ref6","article-title":"ASUS Product Security Advisory","year":"2025","journal-title":"3. Softpedia (https:\/\/www.softpedia.com\/) is a software and tech news website that indexes, reviews and hosts downloadable software and reports news on technology and science topics"},{"key":"ref7","doi-asserted-by":"publisher","DOI":"10.1109\/SP61157.2025.00063"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.14722\/ethics.2023.235691"},{"key":"ref9","year":"2025","journal-title":"Belkin Coordinated Vulnerability Disclosure Program"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1145\/3372115"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1145\/3633500.3633501"},{"key":"ref12","year":"2025","journal-title":"Bug Reporting Guide"},{"key":"ref13","year":"2025","journal-title":"Bugcrowd Standard Disclosure Terms"},{"key":"ref14","volume-title":"Products: Vulnerability Disclosure"},{"key":"ref15","volume-title":"Reporting a Bug"},{"key":"ref16","article-title":"Emerging Issues in Responsible Vulnerability Disclosure","author":"Cavusoglu","year":"2005","journal-title":"Workshop on the Economics of Information Security (WEIS)"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/TSE.2007.26"},{"key":"ref18","doi-asserted-by":"publisher","DOI":"10.14722\/ndss.2016.23415"},{"key":"ref19","article-title":"HALucinator: Firmware Re-hosting Through Abstraction Layer Emulation","volume-title":"USENIX Security Symposium","author":"Clements","year":"2020"},{"key":"ref20","year":"2025","journal-title":"DCS-930L\/DCS-931L\/DCS-932L\/DCS-933L\/DCS-934L\/DCS-5009L\/DCS-5010L\/DCS-5020L\/DCS-5025L\/DCS-5030L:: CVE-2019\u201310999:: Stack Buffer Overflow"},{"key":"ref21","year":"2025","journal-title":"D-Link End-of-Life Policy"},{"key":"ref22","volume-title":"D-Link Report Vulnerability","year":"2025"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1145\/3357767.3357774"},{"key":"ref24","year":"2025","journal-title":"eBay"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1145\/3433210.3453093"},{"key":"ref26","year":"2025","journal-title":"FCC Report Database Report\/Search Tool for FCC Information"},{"key":"ref27","article-title":"Operation Mango: Scalable Discovery of Taint-Style Vulnerabilities in Binary Firmware Services","volume-title":"USENIX Security Symposium","author":"Gibbs","year":"2024"},{"key":"ref28","year":"2025","journal-title":"GitHub"},{"key":"ref29","volume-title":"Communication in the Software Vulnerability Reporting Process","year":"2003"},{"key":"ref30","article-title":"Hobbs","author":"Charles","year":"1853","journal-title":"Rudimentary Treatise on the Construction of Locks, volume 83 of Weale\u2019s Rudimentary Scientific & Technical Series"},{"key":"ref31","article-title":"The CERT Guide to Coordinated Vulnerability Disclosure","author":"Allen","year":"2017","journal-title":"Technical report"},{"key":"ref32","volume-title":"Call for Papers","year":"2026"},{"key":"ref33","doi-asserted-by":"publisher","DOI":"10.1145\/3427228.3427294"},{"key":"ref34","article-title":"Ethical Frameworks and Computer Security Trolley Problems: Foundations for Conversations","volume-title":"USENIX Security Symposium","author":"Kohno","year":"2023"},{"key":"ref35","year":"2025","journal-title":"Linksys End-of-Life and End-of-support Products"},{"key":"ref36","year":"2025","journal-title":"Linksys Product Security"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1145\/3716822"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1145\/3610381.3610383"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1145\/3321705.3329849"},{"key":"ref40","volume-title":"Call for Papers","year":"2026"},{"key":"ref41","year":"2025","journal-title":"End of Service - Consumer Products"},{"key":"ref42","year":"2025","journal-title":"Netgear Product Security"},{"key":"ref43","year":"2025","journal-title":"CVE-2022\u20133561 Detail"},{"key":"ref44","article-title":"NIST National Vulnerability Database","year":"2025","journal-title":"CVE-2024\u201322651 Detail"},{"key":"ref45","year":"2025","journal-title":"CVE-2024\u201326342 Detail"},{"key":"ref46","year":"2025","journal-title":"The Exploit Database"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00154"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/SP40000.2020.00036"},{"key":"ref49","article-title":"Fuzzware: Using Precise MMIO Modeling for Effective Firmware Fuzzing","volume-title":"USENIX Security Symposium","author":"Scharnowski","year":"2022"},{"key":"ref50","doi-asserted-by":"publisher","DOI":"10.1109\/DSN-S58398.2023.00031"},{"key":"ref51","doi-asserted-by":"publisher","DOI":"10.1145\/3338507.3358616"},{"key":"ref52","article-title":"Greenhouse: SingleService Rehosting of Linux-Based Firmware Binaries in User-Space Emulation","volume-title":"USENIX Security Symposium","author":"Tay","year":"2023"},{"key":"ref53","year":"2025","journal-title":"TechInfoDepot Wiki"},{"key":"ref54","year":"2025","journal-title":"Metasploit: The World\u2019s Most Used Penetration Testing Framework"},{"key":"ref55","year":"2025","journal-title":"Routersploit: Exploitation Framework for Embedded Devices"},{"key":"ref56","year":"2025","journal-title":"Download for TD-8811 V1"},{"key":"ref57","year":"2025","journal-title":"TP-Link Product Security Advisory"},{"key":"ref58","volume-title":"Call for Papers","year":"2026"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/TDSC.2023.3334017"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1145\/3533767.3534414"},{"key":"ref61","article-title":"Automatic Firmware Emulation through Invalidity-guided Knowledge Inference","volume-title":"USENIX Security Symposium","author":"Zhou","year":"2021"},{"key":"ref62","year":"2025","journal-title":"ZoomEye Search Engine for Internet Asset Discovery"},{"key":"ref63","year":"2025","journal-title":"ZyXel Reporting a Security Vulnerability"}],"event":{"name":"2026 IEEE Symposium on Security and Privacy (SP)","location":"San Francisco, CA, USA","start":{"date-parts":[[2026,5,18]]},"end":{"date-parts":[[2026,5,21]]}},"container-title":["2026 IEEE Symposium on Security and Privacy (SP)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11573355\/11573356\/11573538.pdf?arnumber=11573538","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,2]],"date-time":"2026-07-02T05:27:56Z","timestamp":1782970076000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11573538\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,5,18]]},"references-count":63,"URL":"https:\/\/doi.org\/10.1109\/sp63933.2026.00180","relation":{},"subject":[],"published":{"date-parts":[[2026,5,18]]}}}