Reporting Security Vulnerabilities

Anyone can submit information about potential security vulnerabilities to the VAHLE CERT via email. Regardless of whether you are a VAHLE customer, we strongly urge you to notify us immediately of any security vulnerabilities you discover.

We greatly appreciate coordinated reports of security vulnerabilities from members of the security community, whether they are security researchers, academics, other CERTs, business partners, government agencies, or other sources.

Our goal is to collaborate professionally with those who report security vulnerabilities in VAHLE products.

Data Protection and Responsible Disclosure

Personal data is processed in accordance with applicable data protection regulations. Reported vulnerabilities must be treated confidentially and must not be made public until authorized by VAHLE.

Please include the following information in your email to help us process your request more quickly (fields marked with * are required to process your report):

• Name of the person submitting
  the report; name and company (if applicable)
  . If you wish to remain anonymous, we will respect your wishes.
• Reporter’s contact information*
  Email address and phone number where we can reach you.
• Affiliation* Please indicate
  your organizational affiliation (if applicable).
• Type of reported security vulnerability/weakness*
  Please describe the nature of the security vulnerability/weakness in detail (e.g., XSS, buffer overflow, hard-coded credentials, etc.) and provide the date it was discovered (if known).
• References*
  Please provide the CVE (if available) and the CVSS score (if known).
• Affected Product and Its Components*
  Please specify in which products, solutions, or services you found the security vulnerability. Be sure to include all available information, such as product name, family, and group, along with the model, serial, or version number, and firmware or software version, as well as photos of the product, preferably showing the product nameplate. For services, specify the relevant location (e.g., URL); for system solutions, specify the project name or project number.
• Assessment and Impact of the Security Vulnerability*
  Please describe any observed impacts resulting from or caused by the security vulnerability, such as effects on confidentiality, integrity, and availability, as well as potential risks or damage. To what extent has the security vulnerability already been disclosed?
• Log Files*
  Please provide us with the log files (if available).
• Steps to Reproduce*
  Please describe the steps that lead to the security vulnerability.
• Tested Firmware Vers^ions*
  Please let us know which firmware versions were tested.

VAHLE CERT would like to thank all reporters for their efforts to work with us to improve the security situation for VAHLE and our customers.

When reporting security vulnerabilities, please note the following:

1. Language of the Report
   : Please submit your report exclusively in German or English to ensure prompt and efficient processing.
2. Publication of Vulnerabilities
   We ask that you do not disclose vulnerabilities publicly before the review is complete and do not publish them without VAHLE’s consent.
3. Compensation
   : Reporting security vulnerabilities does not entitle you to compensation.
4. Updates/Workarounds
   The implementation of updates or workarounds should take into account the respective operating environment, system dependencies, and internal approval processes.