Reporting security vulnerabilities

Anyone can submit information regarding potential security vulnerabilities to the VAHLE CERT via email. Regardless of whether you are a VAHLE customer, we urge you to inform us immediately of any security vulnerabilities you discover.

We greatly value coordinated reports of security vulnerabilities from members of the security community, whether they be security researchers, academics, other CERTs, business partners, government agencies or other sources.

Our aim is to collaborate professionally with those who report security vulnerabilities in VAHLE products.

Data Protection and Responsible Disclosure

The processing of personal data is carried out in accordance with the applicable data protection regulations. Reported vulnerabilities must be treated as confidential and must not be made public until authorised by VAHLE.

Please provide us with the following information in your email to help us process your enquiry more quickly (fields marked with * are required to process your report):

• Name of the person
  making the report; name and company (if applicable)
  . If you wish to remain anonymous, we will respect your wishes.
• Reporter’s contact details*
  Email address and telephone number where we can contact you.
• Affiliation* Please state
  your organisational affiliation (if applicable).
• Type of security vulnerability/flaw reported*
  Please describe the nature of the security vulnerability/flaw in detail (e.g. XSS, buffer overflow, hard-coded credentials, etc.) and state when it was discovered (if known).
• References*
  Please provide the CVE (if available) and the CVSS score (if known).
• Affected product and its components*
  Please specify in which products, solutions or services you found the security vulnerability. Be sure to include all the information available to you, such as product name, family and group, along with the model, serial or version number, and firmware or software version, as well as photos of the product, preferably of the nameplate. For services, please specify the relevant location (e.g. URL); for system solutions, please provide the project name or project number.
• Assessment and impact of the security vulnerability*
  Please describe any effects you have observed that result from or are caused by the security vulnerability, such as those relating to confidentiality, integrity and availability, as well as any potential risks or damage. To what extent has the security vulnerability already been disclosed?
• Log files*
  Please send us the log files (if available).
• Steps
  to reproduce the ^{vulnerability*} Please describe the steps that lead to the security vulnerability.
• Firmware versions
  tested* Please let us know which firmware versions were tested.

VAHLE CERT would like to thank all reporters for their efforts in working with us to improve the security situation for VAHLE and our customers.

Please note the following when reporting security vulnerabilities:

1. Language of the report
   : Please submit your report in German or English only to ensure it can be processed quickly and efficiently.
2. Publication of vulnerabilities
   We ask that you do not disclose vulnerabilities publicly before the assessment has been completed and that you do not publish them without VAHLE’s consent.
3. Remuneration
   : Reporting security vulnerabilities does not entitle you to any remuneration.
4. Updates/workarounds
   The implementation of updates or workarounds should take into account the relevant operating environment, system dependencies and internal approval processes.