March 11, 2019 - Disclosed to Arlo’s 3rd party security partner (managed security disclosures for Arlo)
March 13, 2019 - Arlo’s 3rd party security partner confirms report.
March 16, 2019 - Arlo’s 3rd party security partner confirms Arlo's openness to the coordinated disclosure.
March 21, 2019 - Arlo’s 3rd party security partner states that Arlo is investigating the issues.
March 29, 2019 - Tenable requests status update.
March 29, 2019 - Arlo’s 3rd party security partner requests that specific vulnerabilities be created as separate submissions (Network Misconfiguration, Credentials and sensitive info, GPL code release). Other reported issues are considered duplicates.
March 29, 2019 - Tenable creates 3 new submissions for the above.
March 29, 2019 - Arlo’s 3rd party security partner acknowledges all 3 submissions and closes out the initial report.
April 4, 2019 - Arlo’s 3rd party security partner marks the 3 new submissions as "Triaged."
April 4, 2019 - Arlo’s 3rd party security partner marks original submission as "Not applicable."
April 8, 2019 - Tenable requests status update.
April 9, 2019 - Arlo’s 3rd party security partner/Arlo assign identifiers to two submissions (GPL code and Network Misconfiguration).
April 9, 2019 - Arlo’s 3rd party security partner/Arlo mark GPL code submission as "Not applicable."
April 19, 2019 - Our researcher finds out that Arlo has patched one of the vulnerabilities.
April 19, 2019 - Tenable requests updates on all issues.
April 22, 2019 - Arlo appears to have rolled back patch. Tenable requests updates again.
April 29, 2019 - Tenable requests updates for all issues.
May 3, 2019 - Tenable requests updates on all submissions.
May 10, 2019 - No response from Arlo’s 3rd party security partner or vendor, sent a reminder.
May 17, 2019 - Tenable reaches out to Arlo directly based on the note from Arlo’s 3rd party security partner.
May 21, 2019 - Tenable reaches out to Arlo directly based on the note from Arlo’s 3rd party security partner.
May 21, 2019 - Arlo’s 3rd party security partner marks credentials issue as duplicate.
May 21, 2019 - Arlo’s 3rd party security partner acknowledges Network Misconfiguration issue and valid finding.
May 21, 2019 - It appears Arlo has patched one of the vulnerabilities again that had the fix rolled back.
May 23, 2019 - Tenable meets with Arlo representative. Tenable transitions disclosure from Arlo’s 3rd party security partner to direct communication.
May 23, 2019 - Arlo unable to review latest communication due to PGP confusion.
May 24, 2019 - Tenable confirms PGP key used.
May 28, 2019 - Arlo is unable to decrypt. Provides Onedrive link to upload to.
May 29, 2019 - Tenable uploads disclosure information.
May 30, 2019 - Arlo requests clarification of an issue.
May 30, 2019 - Tenable provides clarification.
June 3, 2019 - Tenable responds to meeting invite.
June 4, 2019 - Arlo and Tenable discuss disclosure timeline
June 11, 2019 - Arlo CIO requests meeting.
June 12, 2019 - Arlo CIO and Tenable CTO discuss disclosure.
June 25, 2019 - Arlo and Tenable meet again.
July 1st, 2019 - Arlo releases their advisory ahead of agreed upon date