Cybersecurity & Product Safety

The KRIWAN PSIRT Area

In the PSIRT area, you will find information about our procedures regarding product safety and cybersecurity issues. If you suspect a vulnerability in a KRIWAN product or would like to report a security incident, please use our reporting portal.

Your Product Security Incident Response Team

When it comes to product safety and cybersecurity issues, action must be taken quickly, in a coordinated manner, and in a way that is transparent. To this end, the KRIWAN PSIRT brings together expertise from product development, software/firmware, IT security, and quality.

We support you in particular by:

• Receipt and triage of vulnerability reports
• Risk assessment and technical analysis in collaboration with the relevant teams
• Recommendations for risk mitigation (e.g., workarounds, configurations)
• Provision of updates/patches, where technically feasible and necessary
• Coordinated communication regarding status, timeline, and next steps

The KRIWAN PSIRT Process

A clear process - from reporting the issue to communicating the corrective actions.

1 - Notification

Notification

You can report a vulnerability using the form or by email. We will confirm receipt and verify that the information provided is complete.

2 - Analysis

Analysis

We assess the relevance and severity, reproduce the issue (if possible), and coordinate the investigation with the relevant teams. You will receive status updates.

3 - Solution

Solution

We develop a corrective measure (e.g., patch/update, workaround, or configuration note), including a timeline. Where appropriate and technically feasible, the effectiveness of the measure can be verified through coordination prior to release.

4 - Closing & Communication

Closing & Communication

Once the assessment is complete and appropriate measures have been implemented, KRIWAN provides information on available measures to minimize or eliminate risks.

What information is helpful for processing this request?

The more specific the information, the faster we can review it and respond.

• Affected product (name/variant)
• Software/firmware version or build/release information
• Description of the vulnerability, including steps to reproduce it
• Expected vs. actual behavior
• Assessment of the impact (e.g., availability/integrity/confidentiality)
• Information on whether the vulnerability is already being exploited (if known)
• Relevant attachments (e.g., logs, screenshots)

Note:

Please do not send any personal information or confidential customer or business data.

Report a Vulnerability (Reporting Center)

We welcome and support the responsible reporting of vulnerabilities.

KRIWAN follows a Coordinated Vulnerability Disclosure Policy (CVD).

The goal is to handle vulnerability reports regarding KRIWAN products in a confidential, coordinated, and transparent manner, and to publish information only once appropriate measures are available or a publication date has been agreed upon with KRIWAN.

We ask reporters to treat information about potential vulnerabilities as confidential and not to disclose it publicly without prior consultation with KRIWAN.

Please limit testing to what is strictly necessary and avoid any disruption to systems, data, or services belonging to KRIWAN, its customers, or third parties. This includes, in particular, unauthorized access to data, modification or deletion of data, social engineering, denial-of-service tests, and tests outside the scope of the affected product.

This policy applies to vulnerability reports regarding KRIWAN products with digital elements, in particular software, firmware, interfaces, communication functions, and product-related digital services.

Recognition as the discoverer may be granted upon request and after consultation, provided there are no legal or security-related reasons to the contrary.