RobustOS Pro Security Assessment
Prepared For: Guangzhou Robustel Co. Ltd
Date of Report: 13th April, 2026
Author Name: Chay Donohoe Author
Disclaimer
The information, representations, statements, opinions, and proposals contained in this document are provided in good faith and are believed to be accurate at the time of writing. However, they are not intended to be, and should not be construed as, legally or contractually binding unless and until incorporated into a separate written agreement executed by the relevant parties.
Any future agreement arising from discussions in connection with this document will be subject to further negotiation and agreed terms and conditions.
Unless otherwise governed by a written confidentiality agreement between the parties, this document contains confidential information belonging to the disclosing party and the recipient. Such information must not be disclosed to any third party without prior written consent from the disclosing party.
Overview
Security testing services were conducted for Guangzhou Robustel Co. Ltd in line with the scope of work outlined in this report. The engagement included the following activities:
- RobustOS Pro Security Assessment
Sample Testing
In order to reduce the time required to perform security testing, sample testing is often conducted where appropriate. For example, if a range of workstations are created from a single image and have (provably) identical (or near identical) configurations, then a sample may be tested as opposed to the entire range. This ‘sample testing’ could also be applied to servers, however it is significantly less likely that the servers will have identical configurations.
It was decided that sample testing would not be appropriate in this assessment, given the relatively small and varied scope submitted.
Caveats
The following assessment caveats were adhered to:
- Denial-of-service attacks should not be attempted.
- Any exploitation code known to potentially cause disruption should not be used.
- Any automated password attacks that could lock out user accounts should not be attempted.
About this Report
This security assessment report is divided into the following sections:
Management Summary
This section provides a high-level overview of the assessment results, enabling readers to quickly understand the overall outcome. It summarises the key findings, including a brief description and associated risk level. Where appropriate, commentary is included to explain the significance of the findings, their potential business impact, and recommended remediation actions.
Detailed Technical Results
This section forms the main body of the report and contains detailed information for each identified finding. Vulnerabilities are described with supporting evidence where applicable (such as screenshots or tool output), risk ratings, remediation guidance, relevant references, and affected systems. Findings identified through both automated and manual testing techniques are included. Informational observations or non-critical issues may also be documented where relevant.
Supporting material that is too extensive or supplementary for inclusion in the main body of the report is provided in this section. This may include extended tool output, enumerated data, configuration extracts, or other collected evidence. Where relevant, references to this material are provided within the detailed findings.
Appendices
This section contains background information relevant to the report but not directly related to specific findings. Examples may include details of the risk rating methodology, testing approach, scope considerations, limitations, or descriptions of tools and techniques used during the assessment.
Assessment Scope
The following assessment scope was submitted by the client and confirmed during the initial briefing with the associated consultant(s). Authorisation to perform security testing on the supplied scope has been supplied and documented in the required authorisation form(s) signed by the client.
Targets
RobustOS Pro Security Assessment
Name
| Hostname
| IP address
| URL |
RobustOS Pro |
|
|
|
Out of Scope
All testing was conducted within the limits of the scope supplied above, mitigating the risk of any breach of the ‘Computer Misuse Act 1990’. The client did not provide any additional hosts within the supplied ranges that should be specifically excluded from the scan.
Management Summary
This section includes a high-level paragraph summarising the overall results of the assessment, allowing ndings with a short description fi readers with little time to gain an understanding of the ‘bottom line’. The key and level of risk are included also. The consultant’s comments further explain the results of each test, their c to the client. fi business impact and the recommended remediation steps specific to the client
High Level Conclusion
During the assessment, it was found that no critical or high risk vulnerabilities were identified, with onlya small number of informational-only issues, indicating a low business risk exposure,
A number of hardening suggestions are present within this report; software and various otherproducts are rarely considered to be secure ’out of the box’ or are not set to the highest security level.A system hardening process involves actions taken to reconfigure systems and applications to adhereto best practices by reducing the attack surface and consequently leading to an improvement of thesecurity posture.
Whilst there was much to be commended in regard to security, Bulletproof recommend thatGuangzhou Robustel Co Ltd resolve all issues found to better improve their stance. Remediation advicehas been provided along with the breakdown of each issue found.
Vulnerability Totals
Assessment Name | CRITICAL | HIGH | MEDIUM | LOW | INFO |
| RobustOS Pro Security Assessment | 0 | 0 | 0 | 0 | 3 |
This section contains the consultant’s comments regarding the results of each assessment performed. The content is aimed at readers who work within the information security field and deal directly with technical employees.
Scope An operating system build review was performed against the RobustOS Pro operating system on Scope behalf of Guangzhou Robustel Co Ltd. The operating system in scope resides on edge computing gateways
The aim of the assessment was to uncover any weaknesses that affect the confidentiality, integrity and availability of RobustOS Pro and was carried out in accordance with the agreed Scope of Works. The assessment was carried out from an authenticated grey-box perspective and was conducted in-line with security best practises. The methodology that was used was comprised of applicable Center for Internet Security (CIS) Linux OS benchmarks, an industry-recognised framework.
The security assessment started by performing automated scans followed by manual checks in order to gather all the necessary information concerning the in-scope target’s functionality, current patch levels, improper configurations and security controls.
The assessment was performed against RobustOS Pro, running on a Commercial Off-The-Shelf (COTS) Robustel EG5120 device. Prior to commencement of the test, all OS packages were updated.
Upon conclusion of the tests, the device was reset back to factory default settings.
Overview The overall security of the tested operating system was found to have a good security posture with three recommendations being made that related to some reasonably easy to remediate misconfigurations, which, where implemented, would further improve the security posture of the operating system.
It is important that Guangzhou Robustel Co Ltd are aware that the vulnerabilities identified in this document are dependent on the time and test limitations given for this penetration test. Other issues may come to light after this test, which is why it is recommended to carry out regular penetration tests.
Caveats The tester did not encounter any issues that were likely to impact the outcome of this report or any of the recommendations that were made as a result.
Appendices
Information associated with the report (but not directly with the specific results of the assessment) will be placed in this section. For example, explanations of the vulnerability risk rating system, testing methodology and descriptions of testing tools may be found here.
Appendix A - Risk Ratings
The table below outlines the security risk rating system used within this report.
The vulnerability rating methodology is based on the Common Vulnerability Scoring System (CVSS) version 3.0, alongside professional judgement following consideration of all relevant testing factors. As a result, the same vulnerability may receive different ratings in different environments depending on contextual risk.
Severity
| CVSS | Description
|
Critical
| 9.0-10.0 | These issues should be resolved as a top priority and are often reported to the client immediately once identified. Critical rated issues are those that are highly likely or are certain to result in a complete loss of confidentiality, integrity or availability. These issues would include those that allow a consultant (or an attacker) to compromise a target host or service. |
HIGH | 7.0-8.9 | These issues should be resolved as a priority, typically being associated with unsupported software versions or services known to have serious vulnerabilities that may potentially have publicly available exploitation scripts. |
MEDIUM | 4.0-6.9 | These issues are those that could potentially lead to a full breach of security but are of a lower risk. For example, a vulnerability that can be identified but for which there is no publicly available exploitation script, or a vulnerability that's exploitation requires a series of unlikely variables to exist,or a vulnerability that can be used to enumerate corporate information deemed aspartially sensitive. |
LOW
| 0.1-3.9 | These issues are those that do not present any immediate threat, but do still present a security issue. These typically include vulnerabilities that disclose partially sensitive information. |
Appendix B - Author Infromation
This report was written by the following consultant. Any questions regarding the report’s contents can be sent to the author directly. This includes any questions regarding the exploitation, remediation and/or business impact of any vulnerability described above.
Author: Chay Donohoe