Security policy and Security Advisories

The security of our products is a high priority for us. However, despite our best efforts to ensure product security, no product can be guaranteed to be 100% secure. Through our security advisories, we aim to provide customers with timely information about security vulnerabilities and recommended mitigation measures to help minimize the risks associated with security threats. We recommend that customers use the latest available versions of our software and firmware. Software and firmware updates should only be downloaded from trusted sources, such as the official COMET website, or obtained directly from COMET technical support. For general questions about COMET products or security-related concerns, please contact our technical support.

How to report a potential security vulnerability

We want to learn about any potential security issues affecting our products so that we can take the necessary steps to address them promptly. To report a potential security vulnerability, please contact our security team at cybersecurity@cometsystem.cz. Your report should be written in English. As vulnerability information is highly sensitive, please do not include technical details in your initial email. Please contact us, and we will provide you with a secure channel for submitting your report. Please note that this email address is intended solely for reporting security vulnerabilities and security incidents and is not intended for general technical support inquiries.

Report handling process

Once a report has been submitted, it will be handled according to the following process:

Reporting new vulnerability - Contact our security team at cybersecurity@cometsystem.cz to report a potential security vulnerability. We will provide instructions on how to securely submit the technical details.
Evaluating - Once we receive the detailed information, we will investigate the report to assess its potential impact on COMET products.
Remediation - If a vulnerability is confirmed, we will determine and implement appropriate measures to mitigate or resolve the issue.
Disclosure - Where appropriate, we will publish information about confirmed vulnerabilities and recommended mitigation measures in a security advisory or bulletin.

Public security advisories

Below is list of publicly provided security advisories. List may to contain commonly know CVE which does not have impact to COMET products.


DATE	DESCRIPTION	IMPACT TO COMET PRODUCTS

2026-11-03	SNMP read vulnerability	No impact
	CVE-2026-119053	The affected code is not used in COMET devices. No additional measures are required.

2026-11-02	TLS and ICMPv6 vulnerabilities	TAx6xx / PA86xx Web Sensors
	CVE-2026-93475, CVE-2026-102758, CVE-2026-102759, CVE-2026-106464, CVE-2026-102714	A security vulnerability has been identified in the second-generation Web Sensor devices (TAx6xx and PAx6xx). The vulnerabilities affect TLS communication and the ICMPv6 protocol. Affected devices are those running firmware version 11-0-1-2 or earlier. We recommend updating the firmware of affected devices to the latest available version. The vulnerabilities are fixed in firmware version 11-0-1-3, which is available for download. As a temporary mitigation for the ICMPv6-related vulnerability, IPv6 can be disabled (it is enabled by default). Please note that disabling IPv6 does not address the TLS-related vulnerabilities and does not replace the recommended firmware update. Based on our internal security impact analysis, the vulnerabilities may be exploited to cause a denial-of-service (DoS) condition. However, due to additional hardware security measures, remote code execution (RCE) is considered unlikely.

2026-10-22	Vulnerabilities in PHP	No impact
	CVE-2026–109618, CVE-2026–109619	COMET does not use PHP at any end-users software or firmware. No additional measures in relation to COMET devices or software are required.

2026-10-05	SNMPv3 protocol vulnerability	WiFi sensors Wx7xx and TAx6xx / PA86xx Web Sensors
	CVE-2026-8836	A security vulnerability has been identified in the SNMPv3 protocol affecting selected devices. The vulnerability affects Wx7xx series Wi-Fi sensors and second-generation WebSensor devices (TAx6xx, PAx6xx). We recommend updating the firmware of affected devices to the latest available version. The vulnerability is not exploitable when SNMP is disabled or when the device is configured to use SNMPv1/v2c, which is the default configuration. The Wx7xx series Wi-Fi sensors are affected when running firmware versions 10-0-5-0 and 10-0-6-0. Other firmware versions are not affected by this vulnerability. The vulnerability is fixed in firmware version 10-0-6-1, which is available for download. Based on internal impact analysis, the vulnerability may be exploited to cause a denial-of-service (DoS) condition. At present, we have not confirmed whether the vulnerability can also be exploited for remote code execution (RCE). Second-generation WebSensor devices (TAx6xx, PAx6xx) are affected when running firmware version 11-0-1-1 or earlier. The vulnerability is fixed in firmware version 11-0-1-2, which is available for download. Based on internal impact analysis, the vulnerability may be exploited to cause a denial-of-service (DoS) condition. Due to additional hardware security measures, the vulnerability cannot be exploited for remote code execution (RCE).

2025-10-07	Authentication vulnerability at COMET Web Sensor devices	No impact.
	CVE-2025-6763	The linked CVE page contains inaccurate statements, particularly the claim that we were contacted by the CVE submitter. The first generation of COMET Web Sensors (Tx5xx/Tx6xx/P85xx/P86xx/Hx5xx/P2520) was shipped with web interface security disabled by default. This is intentional and does not represent a security vulnerability. It is the responsibility of the end user to enable authentication for the web interface. As a best security practice, we recommend enabling authentication for the web interface. We also strongly advise against exposing Web Sensor devices directly to the internet via port forwarding. This recommendation applies to any device connected to a local network, regardless of the manufacturer. For remote access, we recommend using a VPN or a similarly secure method.

2025-04-24	Authentication Flaw in Lantronix Xport	No impact
	CVE-2025-2567	Although some COMET devices uses Lantronix hardware platform, none of COMET device is affected by this vulnerability. All ours devices use COMET proprietary firmware and from this reason are not affected by vulnerability at Lantronix standard fimrware.

2025-03-11	ESP32 hidden HCI commands	No impact
	CVE-2025-27840	COMET does not use ESP32 in any of its manufactured devices.

2022-02-16	Ping Utility Vulnerability	WiFi sensors Wx7xx (firmware version 10.0.3.0 and lower)
	CVE-2021-21966	It was found security vulnerability related to SoC used at WiFi sensors. This vulnerability affects Ping utility inside http server. We have confirmed that WiFi sensors with firmware version 10.0.3.0 and lower are affected by this vulnerability. From this reason we strongly recommand to update firmware to 10.0.4.0 or higher. Latest firmware for WiFi sensors is available at COMET webpages.

2022-02-07	Samba vulnerability	No impact
	CVE-2021-44142	COMET does not use Samba (open-source implementation of SMB protocol) at any end-users software or firmware. No additional measures in relation to COMET devices or software are required.

2021-12-13	Apache Log4j 2.x vulnerabilities	No impact
	CVE-2021-44228, CVE-2021-45046, CVE-2021-45105	COMET does not use Log4j library at any end-users software or firmware. No additional measures in relation to COMET devices or software are required.

2021-05-15	WiFi FragAttacks vulnerabilities	WiFi sensors Wx7xx (firmware version 10.0.2.0 and lower)
	CVE-2020-24588, CVE-2020-26140, CVE-2020-26143	FragAttacks is name for vulnerabilities related to WiFi standard and its implementation disclosed by security researcher Mathy Vanhoef at May 11, 2021. WiFi sensors with firmware version 10.0.2.0 and lower may to be affected by this vulnerabilities. We are not aware about any potential attack vector for WiFi sensors, but we strongly recommend update firmware version to 10.0.2.1 or higher. Firmware which solve these potential issues is available at COMET webpages.

2021-04-29	Potential memory allocation vulnerabilities	WiFi sensors Wx7xx (firmware version 10.0.1.1 and lower)
	CVE-2021-22636, CVE-2021-27429, CVE-2021-27502	Memory allocation vulnerabilities were found at 3rd party development environment used for development of WiFi sensors. At present time we are not aware any way how to exploit this potential vulnerabilities at WiFi sensors. But we strongly recommand to update firmware to 10.0.2.0 or higher. Latest firmware for WiFi sensors is available at COMET webpages.

2020-12-09	Vulnerabilities at TCP/IP stack AMNESIA:33	No impact
	CVE description	COMET does not use TCP/IP stacks (uIP, FNET, picoTCP, Nut/Net) inside any device. No additional measures in relation to COMET devices are required.