# Quest Technical Solutions (QTS) security.txt
# https://www.qtsusa.com/.well-known/security.txt
# Last updated: April 2026

Contact: mailto:security@qtsusa.com

Policy: https://www.qtsusa.com/security/QTS_Vulnerability_Disclosure_Policy.pdf
Acknowledgements: https://www.qtsusa.com/security/QTS_Vulnerability_Acknowledgments.pdf
Preferred-Languages: en

Expires: 2027-04-16T23:59:59Z
Canonical: https://www.qtsusa.com/.well-known/security.txt

# Product-specific notes for AN-X4 series:
#   Researchers are encouraged to test with latest firmware that includes
#   attack surface reduction options:
#   SSH/Web via Kernel v4.05.01.qtk+
#   Modbus TCP via DHP v4.17.01.qtf+
#   RIO Scanner config port 42889 via AN-X4-ABRIO-SCAN.v4.04.01.qtf+
#   RIO Adapter config port 42889 via AN-X4-ABRIO-ADPT.v4.05.01.qtf+
#   Other firmware images (DRV, EIPSCN etc) do not open any additional ports.
#   ports are enabled or disabled by creating specific empty files on the microSD card
#     SSH is disabled by default
#       /Security/enable_ssh to enable
#     Web is enabled by default
#       /Security/disable_web to disable
#     Modbus TCP is enabled by default
#       /SecurityDhp/disable_mbtcp to disable
#     RIO Scanner config port 42889 is enabled by default
#       /SecurityRioScan/disable_qtscfg to disable
#     RIO Adapter config port 42889 is enabled by default
#       /SecurityRioAdpt/disable_qtscfg to disable