Segway releases safety guidelines for e-scooters and apps

Segway-Ninebot has published a new Coordinated Vulnerability Disclosure (CVD) policy for its products with digital elements. According to the manufacturer, it has been in effect since September 1, 2026, and explicitly includes e-scooters, embedded software, mobile apps, and associated cloud services. With this, the company outlines on its German product page how security vulnerabilities should be reported, verified, and resolved.

For riders, this is particularly relevant because modern e-scooters have long been more than just vehicles. App connectivity, Bluetooth, firmware, digital immobilizers, and over-the-air updates are part of everyday life for many models. A formal reporting channel creates a traceable path if researchers or users discover a technical security issue.

What Segway is now specifically committing to

The policy is managed by the Product Security Incident Response Team (PSIRT). Reports should be sent to product-security@ninebot.com; anonymous tips are also possible. For sensitive information, Segway provides a public PGP key.

According to the manufacturer, it intends to acknowledge receipt within three business days and provide an initial assessment within ten business days. During this process, the team will verify whether the reported vulnerability can be reproduced, which products or software versions are affected, and what countermeasures are required.

• Scope: E-scooters, e-bikes, self-balancing vehicles, Navimow robotic mowers, apps, and associated digital services.
• Reporting: Product and model, software or firmware version, error description, and reproducible steps.
• Assessment: Severity according to CVSS 3.1, affected versions, and potential impact.
• Response: Remediation, mitigation, or documented closure; security updates are to be provided free of charge.

90 business days for coordinated disclosure

Confirmed vulnerabilities may initially be handled under embargo. Segway cites 90 business days from confirmation as the standard. This deadline is not a promise that every bug will become public exactly on day 90: according to the policy, it can be adjusted depending on complexity, the supply chain, and risk. The purpose of the procedure is to ensure that details are not published before a fix or security advisory is available.

After a fix is implemented, Segway may publish a security advisory containing the severity, affected versions, and installation path. The page also mentions the possibility of passing information on to the EU Vulnerability Database (EUVD).

Updates and support: two important timeframes

Segway specifies a support period of at least five years for its products with digital elements. The specific end date is intended to be listed on the respective product page at the time of purchase. According to the policy, published security updates will remain available for at least ten years or for the remainder of the support period, whichever is longer.

Updates are to be delivered over the air via the Segway-Ninebot or Navimow app and installed automatically by default. According to the manufacturer, automatic installation can be deactivated in the app settings. Those who disable it should therefore check for updates manually on a regular basis.

What e-scooter riders can do now

1. Keep the Segway-Ninebot app and the scooter's firmware up to date.
2. Check battery levels before an update and do not interrupt the installation.
3. In the event of unusual app or vehicle behavior, first document the model, firmware version, and app version.
4. Report a suspected technical security vulnerability to the PSIRT with reproducible steps; general defects and service issues should continue to be handled by customer service.
5. Do not share exploit details or third-party data publicly before a problem has been verified and resolved.

For owners of older models, one point remains open: although the manufacturer describes a minimum duration and refers to an end date on product pages, the dynamic support table on the security page could not be fully read at the time of our review. Buyers should therefore check the specific model and the stated end-of-support date on the respective product page and document this information.

Why this is important for connected scooters

The more closely driving functions, locks, location data, and user accounts are linked, the more important a clean approach to handling software bugs becomes. A clear reporting channel helps security researchers direct technical findings to the right place. For users, two things are crucial: updates must actually be received, and the promised support period must be transparent for the specific model.

Quelle

Segway-Ninebot: Product Security and Coordinated Vulnerability Disclosure Policy, Version 1.0, valid from September 1, 2026; accessed on September 20, 2026.

Note: This article provides context for publicly available manufacturer information. It is not confirmation of a specific vulnerability and does not constitute technical or legal advice. Source status: September 20, 2026.