This page explains how to report a security problem in a dpCREATOR product and how long each product gets security updates. It is our vulnerability disclosure policy under the EU Cyber Resilience Act and the UK Product Security and Telecommunications Infrastructure (PSTI) rules.
Report a security problem
Email security@dpcreator.eu. We reply within 5 working days and keep you updated until it is fixed.
It helps if you tell us:
- the product and model (for example DPC-R3 v4.0.3 or DPC-TABUI) and the firmware build (shown in the WebUI footer or on the Flash Firmware page);
- what you found and how to reproduce it;
- what an attacker could do with it, as far as you know;
- how we can credit you, if you would like to be named.
Please give us a reasonable time to fix the problem before you publish details, and do not access other people's machines or data while testing. We will not take action against anyone who reports in good faith and follows this page. When a fix is released, we say so in the release notes and credit the reporter if they wish.
Machine-readable contact: /.well-known/security.txt.
Supported products and security updates
| Product | Software | Security updates until at least |
|---|---|---|
| DPC-R3 controller (and the R3 in the DPC-R3-TABUI combo) | dpCREATOR FluidNC firmware and dpCREATOR WebUI | 31 December 2031 |
| DPC-TABUI SmartTabUI pendant (and the pendant in the combo) | SmartTabUI pendant firmware | 31 December 2031 |
Updates are free and are installed over USB from dpcreator.eu (Flash Firmware page). The controller does not accept firmware over the network.
Security by design
- No default passwords. You set your own admin password (8 to 64 characters) the first time you open the WebUI. The controller's own Wi-Fi access point stays off until you set an access-point password.
- Every network route of the controller, including the file manager, asks for the login. Repeated wrong passwords lock that address out for a while.
- Telnet is off by default, and wired Ethernet is the default network.
- The SmartTabUI pendant does not use Wi-Fi or Bluetooth; it talks to the controller over its cable only.
- Use the controller on your local network only. Never forward its ports to the internet: the WebUI uses plain HTTP inside your network.
Forgot the password? Connect over USB (Flash Firmware page, terminal) and send $Auth/Set=<new password>, or $Auth/Clear to set a new one in the WebUI.
What the WebUI sends to dpcreator.eu
About once a day the WebUI asks dpcreator.eu whether a newer build exists. It sends the board ID, the pendant ID and the build numbers over HTTPS, and nothing else. You can switch this off with "update check" in the WebUI footer. See the Privacy Policy.
Statement of compliance
The DPC-R3 and DPC-TABUI are designed to meet the security requirements for connectable products in the UK (PSTI) and the EU (Radio Equipment Directive, EN 18031-1): no universal default passwords, a published way to report security issues (this page), and a published minimum security-update period (the table above).