Prepared For: Guangzhou Robustel Co. Ltd

Date of Report: 15th July, 2026

Author Name: Josh Sewell

The information, representations, statements, opinions, and proposals contained in this document are provided in good faith and are believed to be accurate at the time of writing. However, they are not intended to be, and should not be construed as, legally or contractually binding unless and until incorporated into a separate written agreement executed by the relevant parties.

Any future agreement arising from discussions in connection with this document will be subject to further negotiation and agreed terms and conditions.

Unless otherwise governed by a written confidentiality agreement between the parties, this document contains confidential information belonging to the disclosing party and the recipient. Such information must not be disclosed to any third party without prior written consent from the disclosing party.

Security testing services were conducted for Guangzhou Robustel Co. Ltd in line with the scope of work outlined in this report. The engagement included the following activities: Robustel Cloud Manager Service (RCMS) Security Assessment.

The purpose of the assessment is to identify any software or configuration vulnerabilities that could be exploited by an attacker. This includes, (but is not limited to) outdated software packages, SSL/TLS configuration issues, weak authentication controls, weak input validation controls, lack of output encoding, lack of security headers, information disclosure issues, business logic problems.

Given the nature of Guangzhou Robustel Co. Ltd’s business, it is necessary for them to store and process clients’ information. It is critical that this highly sensitive information be secured through an ongoing defence in depth approach. This assessment forms part of a larger security project, ensuring that any vulnerabilities associated with the web application assessment are identified and remediated.

In order to reduce the time required to perform security testing, sample testing is often conducted where appropriate. For example, if a range of workstations are created from a single image and have (provably) identical (or near identical) configurations, then a sample may be tested as opposed to the entire range. This ‘sample testing’ could also be applied to servers, however it is significantly less likely that the servers will have identical configurations.

It was decided that sample testing would not be appropriate in this assessment, given the relatively small and varied scope submitted.

The following assessment caveats were adhered to:

This section provides a high-level overview of the assessment results, enabling readers to quickly understand the overall outcome. It summarises the key findings, including a brief description and associated risk level. Where appropriate, commentary is included to explain the significance of the findings, their potential business impact, and recommended remediation actions.

This section forms the main body of the report and contains detailed information for each identified finding. Vulnerabilities are described with supporting evidence where applicable (such as screenshots or tool output), risk ratings, remediation guidance, relevant references, and affected systems. Findings identified through both automated and manual testing techniques are included. Informational observations or non-critical issues may also be documented where relevant.

Supporting material that is too extensive or supplementary for inclusion in the main body of the report is provided in this section. This may include extended tool output, enumerated data, configuration extracts, or other collected evidence. Where relevant, references to this material are provided within the detailed findings.

This section contains background information relevant to the report but not directly related to specific findings. Examples may include details of the risk rating methodology, testing approach, scope considerations, limitations, or descriptions of tools and techniques used during the assessment.

The following assessment scope was submitted by the client and confirmed during the initial briefing with the associated consultant(s). Authorisation to perform security testing on the supplied scope has been supplied and documented in the required authorisation form(s) signed by the client.

This section includes a high-level paragraph summarising the overall results of the assessment, allowing readers with little time to gain an understanding of the ‘bottom line’. The key findings with a short description and level of risk are included also. The consultant’s comments further explain the results of each test, their business impact and the recommended remediation steps specific to the client.

The assessment results indicate that the overall security posture of the web applications in scope is strong, with clear examples displayed in areas designed with security in mind and the absence of any critical or high-severity vulnerabilities now present.

However, with this said, there are still some opportunities where security may be further improved through reconfiguring existing web application mechanisms.

Through reconfigurations of the assessed applications, Guangzhou Robustel Co. Ltd's would see a reduction in the size of its digital threat landscape. This, in turn, would ensure the integrity, confidentiality, and availability of the application are upheld should an external threat actor attempt to leverage any weakness.

The assessment identified several informational findings that, while individually low risk, could increase the overall attack surface if left unresolved. Although no critical or high-severity vulnerabilities were identified, addressing these findings would improve the organisation's security posture and reduce opportunities for attackers to chain together multiple weaknesses.

One particular finding is the use of outdated JavaScript libraries. Updating the affected libraries should be prioritised. Keeping these libraries up-to-date is crucial, as updates often include the latest features, security patches, and performance enhancements. By using the latest versions, you not only improve your application's functionality and efficiency but also protect it against potential vulnerabilities. Regularly checking for updates and implementing them promptly can significantly contribute to the smooth and secure operation of your software solutions. Always refer to the official documentation or repositories for the latest versions and best practices when upgrading your JavaScript libraries.

Perhaps the environment would benefit from the implementation of a patch management system, which would help mitigate any issues surrounding the outdated software versions. An effective patch management system involves acquiring, testing, and installing patches, fixes, updates, or code changes to a network and its systems. Furthermore, this includes maintaining current knowledge of available patches and deciding which patches are appropriate for particular systems, therefore ensuring that patches are installed properly. Additionally, this ensures documenting all associated procedures, such as specific configurations required. Patches, fixes, and updates are periodically released by most major software companies, which can address security vulnerabilities, introduce new features, and bring improved software stability. It should be noted that patches, fixes, and updates should be tested before they are administered into live systems. As such, occasionally, a patch can introduce problems that did not previously exist.

The Content Security Policy (CSP) includes the "unsafe-eval" directive, which allows JavaScript to execute strings as code. Although this is not directly exploitable on its own, it weakens browser protections against Cross-Site Scripting (XSS). If an XSS vulnerability were introduced, "unsafe-eval" could increase its impact by allowing arbitrary script execution, potentially leading to session hijacking or credential theft. Removing this directive and replacing any functionality that depends on string evaluation would strengthen client-side security.

Lastly, concurrent user sessions across multiple devices and browsers is permitted. While this is a common design choice, it allows an attacker with valid credentials to maintain access until their session expires or is explicitly revoked. Without visibility into active sessions, users may be unaware of unauthorised access. If appropriate for the application's security requirements, session management could be improved by limiting concurrent logins or providing users with the ability to view and terminate active sessions.

Overall, the assessment did not identify any critical security issues. However, updating the vulnerable JavaScript libraries and removing the "unsafe-eval" directive should be prioritised, as they provide the greatest reduction in risk with minimal implementation effort. Addressing the remaining findings would further reduce the application's attack surface and strengthen its overall security.

Information associated with the report (but not directly with the specific results of the assessment) will be placed in this section. For example, explanations of the vulnerability risk rating system, testing methodology and descriptions of testing tools may be found here.

The table below outlines the security risk rating system used within this report.

The vulnerability rating methodology is based on the Common Vulnerability Scoring System (CVSS) version 3.0, alongside professional judgement following consideration of all relevant testing factors. As a result, the same vulnerability may receive different ratings in different environments depending on contextual risk.

This report was written by the following consultant. Any questions regarding the report’s contents can be sent to the author directly. This includes any questions regarding the exploitation, remediation and/or business impact of any vulnerability described above.

Author: Josh Sewell