Report a Vulnerability

To report a security vulnerability, send an email to security@leibinger-group.com.

Please include the following information, if available:

• Product name, model, and firmware/software version (reference/part number, if applicable)

• Specific configuration required to reproduce the issue

• Step-by-step instructions for reproducing the issue

• Proof of Concept (PoC) or exploit code (if available)

• Impact, including possible attack vector (Attack Scenario)

• • Additional relevant information (e.g., logs/network traces) and disclosure status (Link/source)
•  
•  

We typically acknowledge receipt within 7 business days.

 

The LEIBINGER Group does not intend to take legal action against individuals who act responsibly and adhere to the following principles:

• Testing/research without causing harm to people, systems, or data.

• • Tests without disrupting customer environments, or only with the express permission/consent of the owners.
•  
  • • Compliance with applicable laws and no discernible criminal intent.
  •  
• • Coordinated disclosure: No publication of vulnerability details before a mutually agreed-upon deadline has expired or before a fix or mitigation is available.
•  
• • No compromise to the security or privacy of third parties (in particular, no data exfiltration, no DoS attacks, and no security risks).
•  
•  
• We treat reports confidentially to the extent permitted by law and maintain a reliable communication channel throughout the entire process.

 

Vulnerability Analysis and Remediation

LEIBINGER investigates the report and reproduces/validates the vulnerability. If necessary, we ask the reporting party for additional information to complete the analysis.

The vulnerability is remedied by the responsible development and product teams. During this process, we maintain regular communication with the reporting party—as appropriate—to provide status updates and avoid misunderstandings. Subsequently, LEIBINGER develops appropriate fixes—if necessary—and prepares them for distribution.

Where appropriate and possible, relevant CERT/CSIRT agencies may be involved early on for coordination. If available, pre-release versions of fixes/updates may be provided to the reporting party for verification.

Publication

For publication, we use existing customer notification processes, such as direct notification or the publication of a security advisory on our website.

A security advisory typically includes:

• Description of the vulnerability, including CVE reference and CVSS score (if applicable)

• Affected products and software/hardware versions

• Information on mitigations/workarounds

• Reference/link to the availability of fixes/updates (download/release notes)

• • Upon request and with consent: credit for reporting and cooperation
•  
•  

 Where justified, the public release of detailed information regarding a resolved vulnerability may be delayed if this enhances user security (e.g., to allow time for patching).