Report a vulnerability

We take vulnerabilities in our products and in our IT seriously. If you have found one, please report it to us. We review every report and keep you informed about its progress.

Contact

vulnerability@noeding-messtechnik.de

This address is our single point of contact for security reports. It covers vulnerabilities in our products as well as in our website, our servers and our corporate IT.

You can also reach us by phone at +49 40 675851-0, Monday to Thursday from 08:00 to 15:00 and Friday from 08:00 to 12:00 (time zone Europe/Berlin), except on public holidays in Hamburg. Please send the technical details in writing afterwards so that nothing gets lost.

Details that help us

Where possible, please tell us the affected product with version and serial number or the affected address, a description of the vulnerability and its possible impact, and the steps needed to reproduce the behaviour. A proof of concept and an assessment of the severity, for example as a CVSS vector, speed up our review.

The most important detail for us is whether the vulnerability is already being exploited. That information triggers immediate action on our side. Please point it out if you have any indications.

We need a way to contact you for follow-up questions.

How we proceed

You will receive a personal acknowledgement within five working days. After the technical review we will come back to you within ten working days with substantive feedback. We remain available to you until the process is complete.

The full rules under which we handle reports and disclose vulnerabilities are set out in our coordinated vulnerability disclosure policy.

Legal notes

We treat your report confidentially. We do not disclose personal data to third parties without your explicit consent unless we are required to do so by law or by an order of a public authority or a court. We do not require a non-disclosure agreement.

As long as you comply with our CVD policy, we will refrain from criminal charges and civil claims.

We do not pay bounties for reported vulnerabilities and do not maintain a public acknowledgements page.

Reporting without giving your name

You do not have to give us your name. A report from an anonymous but reachable email address is a regular report for us and is handled like any other. We do not ask who is behind it.

Please note, however, that without an address where we can reach you we cannot ask follow-up questions. Reports with no contact option at all can therefore only be processed to a limited extent and possibly not at all.

Not a security matter?

For questions about products, complaints and orders, please contact info@noeding-messtechnik.de.

Privacy

Information on how we process your data is available in our privacy policy.