You have found a security vulnerability?

Our goal is to address potential vulnerabilities quickly and transparently. To submit a report, you can contact us via our reporting email address cvd.report@ebe.de

Please note that we do not consider (D)DoS attacks and social engineering attacks to be vulnerabilities within the scope of a Coordinated Vulnerability Disclosure (CVD).

Information we need

To ensure that we can review your report efficiently and avoid the need for follow-up questions, we need at least the following information:

Description of the Vulnerability

The more information you can provide us about the vulnerability, the faster we can determine its exact source.

Affected Product and Version

So that, if necessary, we can warn our users and fulfill our reporting obligations faster.

Steps for Reproduction

A description of the steps allows us to independently verify and prioritize the issue.

Your contact information

For questions and status updates (email or, if necessary, by phone).

You’re safe with us

We grant you Safe Harbor protection provided that the report is made in good faith and without unauthorized access or intent to cause harm. We undertake not to take any legal action against you as long as you comply with the conditions listed above.

What Happens After You File a Report

Once we receive your report, you will promptly receive a confirmation of receipt via email. Your report will then be reviewed by the relevant developers. During this process, we will analyze the reported vulnerability, assess its impact, and prioritize it based on its severity. If we have any questions or need additional information, we will contact you directly.

We will keep you informed of our progress throughout the entire process. Once validation is complete, we will develop a fix and release an update for the affected version no later than 90 days after receiving your report.

Are you planning to publish your discovery yourself? Please feel free to contact us to coordinate the publication.

In accordance with regulatory requirements, particularly those set forth in the Cyber Resilience Act (CRA), we duly report relevant security incidents and vulnerabilities to the appropriate authorities.

Thank you very much!

We would like to thank you for taking the time to help us ensure the safety of our products and protect all users.