Purpose
Exentec is committed to maintaining the security, safety and cyber resilience of its products with digital elements.
This Coordinated Vulnerability Disclosure (CVD) Policy explains how security researchers, customers, partners, and other third parties can report vulnerabilities to Exentec, and how we handle, remediate, and disclose them.
This policy supports Exentec’s vulnerability handling process and its obligations under applicable cybersecurity laws, including Regulation (EU) 2024/2847 (Cyber Resilience Act).
Scope
This policy applies to suspected security vulnerabilities affecting Exentec products with digital elements, including firmware, software, embedded components, and, where applicable, digital services that are necessary for a product to perform its intended functions.
Excluded from scope:
- Physical security vulnerabilities without cybersecurity impact
- Third-party services not under Exentec's control
- Social engineering, phishing, spam, or physical attacks
- Denial-of-service testing, load testing, or disruptive activities
Where a reported issue relates to a third-party component embedded within an Exentec product, Exentec may assess and coordinate the report with the relevant supplier or maintainer as appropriate.
How to report a vulnerability
Please report suspected vulnerabilities to Exentec by email:
Email: security@exentec.net
Reports should be submitted in English whenever possible.
Exentec treats vulnerability reports and related communications as confidential and processes information in accordance with applicable legal, regulatory, confidentiality, and data protection obligations.
Please do not report security vulnerabilities through public forums or social media.
Information to include in your report
Please include as much of the following information as possible:
- Affected product, including model, firmware or software version, and configuration details where available
- Description of the vulnerability, including potential impact and step-by-step reproduction instructions
- Supporting information, such as proof-of-concept code, logs, traces, or other technical evidence
- Public references, if there are any. Please indicate if the vulnerability has already been publicly disclosed or actively being exploited
Your contact information (optional)
How Exentec handles vulnerability reports
Exentec operates a coordinated vulnerability disclosure process intended to support responsible reporting, timely remediation, risk reduction, and appropriate public disclosure.
Where appropriate, Exentec may:
- Acknowledge receipt of the report
- Validate and assess the vulnerability
- Determine severity and potential impact
- Develop corrective or mitigating measures
- Coordinate with affected suppliers, maintainers, or partners
Publish a security advisory when appropriate
Exentec may communicate with the reporter during the assessment and remediation process where additional information or clarification is required.
Security advisories may include affected products, severity, CVE identifier, remediation guidance, fixed versions, and reporter acknowledgement where agreed.
EU Cyber Resilience Act Reporting
Where required under Regulation (EU) 2024/2847 (Cyber Resilience Act), Exentec will report actively exploited vulnerabilities and severe security incidents affecting products with digital elements to the designated CSIRT and ENISA within the applicable statutory timeframes.
Safe Harbour
Exentec welcomes and supports responsible security research.
Exentec does not intend to pursue legal action against individuals who act in good faith, comply with this policy, avoid harm to users and systems, and provide Exentec with a reasonable opportunity to investigate and remediate reported vulnerabilities before public disclosure.
This safe harbour applies only to lawful, responsible, and non-disruptive security research and does not apply to activities that are unlawful, malicious, reckless, deceptive, or harmful.
Supply Chain Coordination
Where a vulnerability affects a third-party or open-source component used within an Exentec product, Exentec may coordinate remediation and disclosure activities with the relevant supplier, maintainer, manufacturer, or upstream project.
Please include component names, versions, repositories, or supplier details where available.
Confidentiality and Acknowledgement
Exentec treats vulnerability reports as confidential and expects reporters to do the same until coordinated disclosure has occurred or Exentec has approved public disclosure.
With the reporter’s consent, Exentec may publicly acknowledge individuals or organizations that responsibly report confirmed vulnerabilities.
Disclaimer
This policy is a voluntary invitation to report vulnerabilities and does not create contractual obligations beyond those provided by applicable law.
Nothing in this disclaimer is intended to limit Exentec's obligations under applicable law, including the Cyber Resilience Act where applicable.