CRA – Security Reporting

Cyber Resilience Act

Reporting Security Vulnerabilities

The security of our products with digital elements is a high priority for us. We aim to identify and address potential security risks at an early stage in order to provide the best possible protection for our products and their use.
If you identify a potential security vulnerability in one of our products, we welcome responsible and confidential disclosure. Your information helps us assess risks and initiate appropriate measures.

Contact

To help us investigate the issue as efficiently as possible, please provide the following information, where available:

• Name and designation of the affected product
• Product version and, where applicable, firmware version
• Description of the identified security issue
• Information on the steps required to reproduce the issue
• Assessment of the potential impact and associated risks
• Contact details for any follow-up questions

You are welcome to report your findings even if not all of the above information is available.
E-Mail: psirt@peter-electronic.com

Principles of Responsible Disclosure

When investigating and reporting security vulnerabilities, we ask that you act responsibly. In particular, please observe the following principles:

• Do not publicly disclose details of the vulnerability until we have had sufficient time to investigate it and assess appropriate mitigation measures.
• Avoid investigations or tests that could adversely affect individuals, production systems, customer data, or other sensitive information.
• Limit your testing to what is necessary to provide a clear and reproducible description of the vulnerability.

Data Protection

We treat all information provided in connection with a vulnerability report as confidential and use it to investigate, assess, and address the reported security issue. In doing so, we comply with the applicable data protection requirements.

Vulnerability Handling Process

Incoming security reports are coordinated by the CRA Coordinator, who serves as the central point of contact for such reports.
Upon receipt of a report, we investigate the issue. In particular, we assess its technical relevance, potential impact, and exploitability. Based on this assessment, we determine the necessary measures to mitigate the risk and remediate the vulnerability.
Where legally required, the competent authorities will be notified in accordance with the applicable requirements of the Cyber Resilience Act (CRA).