Coordinated Vulnerability Disclosure Policy

This policy applies to the following products and services developed or distributed by Panelmate:

• —Hardware
• —Firmware
• —Software
• —Industrial control systems (ICS)
• —Human-machine interfaces (HMI), UPS systems, extenders, PLCs and remote I/O
• —Gateways, communication devices, cloud services and remote support platforms

Vulnerabilities should be reported to our Product Security Incident Response Team (PSIRT) at the address below.

Please include as much technical detail as you can. The items below are what allow our team to reproduce, assess and resolve a report quickly — send whatever of it you have.

Product or asset affected

Model and serial number, product or service name, product code, and the affected component or function.

Version

Hardware, firmware and software versions, and any specific configuration required for the vulnerability to exist.

Vulnerability type

The weakness category — for example a CWE classification, if known.

Severity

A severity rating, for example CVSS v4, if you have one.

Technical description

A summary of the vulnerability, the steps and configuration needed to reproduce it, any screenshots or logs, and any temporary mitigation you have already identified.

Potential impact

The effect on the confidentiality, integrity or availability of the product or system, and any effect on functional safety, operational continuity or the environment.

Panelmate follows a coordinated vulnerability disclosure process. We ask researchers to:

• —Not disclose the vulnerability publicly before a fix has been published
• —Avoid any activity that could compromise system availability
• —Not access, modify or disclose third-party data
• —Cooperate with us during verification

We will maintain an ongoing dialogue with the reporter throughout the entire vulnerability management process.

Every report follows the same process:

1. 01Registration of the report
2. 02Acknowledgement of receipt
3. 03Technical analysis and verification that the issue reproduces
4. 04Severity assessment using the CVSS methodology
5. 05Identification of every affected product
6. 06Definition of corrective action
7. 07Development and validation of the patch or mitigation
8. 08Publication of the security advisory
9. 09Release of the security update
10. 10Closure of the report

• —Acknowledge receipt of a vulnerability report within five business days
• —Provide periodic status updates while the investigation is open
• —Notify the reporter once remediation is complete and the security advisory has been published

Published advisories are listed here. Security updates are distributed through this website, and each one includes release notes, the vulnerabilities fixed, the associated CVE identifiers where applicable, the supported versions and installation instructions.

No security advisories have been published to date.

Each advisory carries:

• —Advisory ID
• —Publication date
• —Affected products and versions
• —Severity rating (CVSS)
• —Associated CVE identifiers
• —Remediation instructions
• —References to the security updates and patches

This lets you assess your own exposure and apply corrective action in good time.

Information on the support lifecycle of each product — including its security maintenance period and end-of-support date — is published in that product’s documentation and on its support page.

Information received through this channel is processed solely for the purpose of managing the reported vulnerability, in compliance with Regulation (EU) 2016/679 (GDPR).