How to Report a Potential Security Vulnerability
For congatec, the security of our products is important, and we take any potential security vulnerability seriously. We are committed to continuously enhancing the security measures of our products. congatec ensures that customers are promptly informed of any potential security vulnerability.
If you identify any vulnerabilities in our products, please report them via the following email: vulnerability@congatec.com. For any security vulnerability reported to congatec, we will provide further details and actions in a timely manner via a dedicated ticket or email.
Recommended Information to Include
To help us properly evaluate a potential security vulnerability, please include the following information in your email:
- Your contact information and availability
- The affected congatec product, including part number, name, revision, and/or version (hardware and software).
- A complete technical description of the potential vulnerability, including any known related exploits.
- Step-by-step instructions to reproduce the issue.
- Details on how and when the potential vulnerability was discovered.
- Any public information already published or planned for publication (e.g., CVE, academic paper, etc.)
Security Incident Response Process
- Notification: congatec receives the report and acknowledges its receipt.
- Review: congatec reviews the report to determine whether a congatec product may be affected and whether the information provided is sufficient for investigating the issue. We may contact the submitter if further clarification or additional information is needed.
- Technical analysis: congatec's technology department investigates the potential vulnerability.
- Corrective action: If the vulnerability is verified, congatec will take appropriate actions to remedy the issue.
- Disclosure: When appropriate, congatec will disclose information about the verified vulnerability and may publish countermeasures or workarounds, depending on the severity of the issue. Security Vulnerability Disclosures will be provided for exploited and severe incidents.
- Published Vulnerability Disclosures: An overview of all published vulnerability disclosures for congatec products is available on the conga-Wiki This overview is independent of the CVSS scoring and represents a full list of security incidents. Note: a login is required that you can get from your Sales Representative or FAE contact.
| Step | What We Do for You | When It Happens |
|---|---|---|
| We Receive Your Report | Personal confirmation in ≤ 1 working day. | Immediately |
| Quick Triage | • Verify that the issue is related to a congatec product. • Check if information is sufficient; ask for clarification (normally within 2 days). • Spam and support request topics will be separated and forwarded correctly. | ≤ 2 days after acknowledgement |
| Technical Investigation | • Reproduce the issue in a secure lab. • Perform root cause analysis and calculate a full congatec related CVSS v3.1 score. | in timely manner |
| Classification of the vulnerability and initial reporting | In case a vulnerability is affecting congatec products it will be classified • actively exploited vulnerability: ENISA reporting and active Vulnerability Reporting to customers • severe vulnerability: ENISA reporting and active Vulnerability Reporting to customers • important vulnerability (not exploited, nor severe): active Vulnerability Reporting to customers; • no critical vulnerability: vulnerability that can be handled via standard updates; For any kind of vulnerability it will be documented and updated via the congatec wiki page. | dependent on case: actively exploited and severe: 24 hours Rest: in timely manner |
| Deciding the Fix | • If verified – start a patch/firmware update, a configuration hardening, or (if a fix is not feasible) a detailed mitigation work around. • Vulnerability Disclosure will be updated in case of relevant changes to the initial vulnerability report provided | Rest wikipage provides updates |
| Delivering the Remedy | • Tested, digitally signed update uploaded to our secure portal. • customer needs to actively download the fix via the customer portal. • Vulnerability Disclosure will be updated with final fix information on the wiki page | As soon as the analysis are finished. Fix to be available within following time periods. Exploited vulnerability: 2 weeks Severe: 4 weeks Remaining vulnerabilities will be updated constantly on the wiki page |
| Vulnerability Disclosure (when appropriate) | • Publish a security advisory on the conga Wiki (login supplied by your Sales Rep/FAE). • Advisory includes CVE ID, affected versions, severity, remediation steps, and a link to the signed update. • For severe or exploited cases, the notice is released within 30 days of the fix (or earlier if required by law). | Within 30 days of the fix (or earlier for active exploits) |
| Access to All Disclosures | • Full index of every vulnerability (with or without CVE) on the conga Wiki. • Login credentials obtained from your Sales Representative or Field Application Engineer. | Ongoing |