{"id":52662,"date":"2026-09-15T10:22:13","date_gmt":"2026-09-15T08:22:13","guid":{"rendered":"https:\/\/www.mesutronic.de\/?page_id=52662"},"modified":"2026-09-15T11:11:20","modified_gmt":"2026-09-15T09:11:20","slug":"cvd-policy","status":"publish","type":"page","link":"https:\/\/www.mesutronic.de\/en\/cvd-policy\/","title":{"rendered":"CVD policy"},"content":{"rendered":"\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-1a2lljy-6598de7a3dcd4602e583c9a2ebbb402d\">\n.avia-section.av-1a2lljy-6598de7a3dcd4602e583c9a2ebbb402d{\nbackground-repeat:no-repeat;\nbackground-image:url(https:\/\/www.mesutronic.de\/wp-content\/uploads\/2023\/08\/mesutronic_gebaude_neu_02.jpg);\nbackground-position:50% 100%;\nbackground-attachment:scroll;\n}\n<\/style>\n<div id='av_section_1'  class='avia-section av-1a2lljy-6598de7a3dcd4602e583c9a2ebbb402d main_color avia-section-huge avia-no-border-styling  avia-builder-el-0  el_before_av_section  avia-builder-el-first  with-mask overlay avia-bg-style-scroll container_wrap fullsize'  data-section-bg-repeat='no-repeat'><div class='container av-section-cont-open' ><main  role=\"main\" itemprop=\"mainContentOfPage\"  class='template-page content  av-content-full alpha units'><div class='post-entry post-entry-type-page post-entry-52662'><div class='entry-content-wrapper clearfix'>\n\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-nvhlem-af2840bc5efbde17028474f839101cdd\">\n#top .flex_column.av-nvhlem-af2840bc5efbde17028474f839101cdd{\nmargin-top:100px;\nmargin-bottom:100px;\n}\n.responsive #top #wrap_all .flex_column.av-nvhlem-af2840bc5efbde17028474f839101cdd{\nmargin-top:100px;\nmargin-bottom:100px;\n}\n<\/style>\n<div  class='flex_column av-nvhlem-af2840bc5efbde17028474f839101cdd av_two_third  avia-builder-el-1  avia-builder-el-no-sibling  first flex_column_div  '     ><style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-ljzk5lye-28ff9d2868a4bef5cbeff252abbd332a\">\n#top .av_textblock_section.av-ljzk5lye-28ff9d2868a4bef5cbeff252abbd332a .avia_textblock{\ncolor:#ffffff;\n}\n<\/style>\n<section  class='av_textblock_section av-ljzk5lye-28ff9d2868a4bef5cbeff252abbd332a '   itemscope=\"itemscope\" itemtype=\"https:\/\/schema.org\/CreativeWork\" ><div class='avia_textblock av_inherit_color'  itemprop=\"text\" ><h1>Company<\/h1>\n<\/div><\/section><\/div>\n\n<\/div><\/div><\/main><!-- close content main element --><\/div><\/div><div id='av_section_2'  class='avia-section av-2hxy5z2-1aa12673bd1116c2f29aa4d5b4639cf7 main_color avia-section-default avia-no-border-styling  avia-builder-el-3  el_after_av_section  avia-builder-el-last  avia-bg-style-scroll container_wrap fullsize'  ><div class='container av-section-cont-open' ><div class='template-page content  av-content-full alpha units'><div class='post-entry post-entry-type-page post-entry-52662'><div class='entry-content-wrapper clearfix'>\n<div  class='flex_column av-25yyh5q-dbfe59f7cfd2dc3354e0132686a2a913 av_one_full  avia-builder-el-4  el_before_av_one_full  avia-builder-el-first  first flex_column_div  '     ><style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-lj438d9i-00ed9ca5d53fa59a0414dc41a2dd663f\">\n#top .av-special-heading.av-lj438d9i-00ed9ca5d53fa59a0414dc41a2dd663f{\npadding-bottom:10px;\n}\nbody .av-special-heading.av-lj438d9i-00ed9ca5d53fa59a0414dc41a2dd663f .av-special-heading-tag .heading-char{\nfont-size:25px;\n}\n.av-special-heading.av-lj438d9i-00ed9ca5d53fa59a0414dc41a2dd663f .av-subheading{\nfont-size:15px;\n}\n<\/style>\n<div  class='av-special-heading av-lj438d9i-00ed9ca5d53fa59a0414dc41a2dd663f av-special-heading-h2 blockquote modern-quote  avia-builder-el-5  avia-builder-el-no-sibling '><div class='av-subheading av-subheading_above'><p>Mesutronic<\/p>\n<\/div><h2 class='av-special-heading-tag '  itemprop=\"headline\"  > Coordinated vulnerability disclosure policy (CVD)<\/h2><div class=\"special-heading-border\"><div class=\"special-heading-inner-border\"><\/div><\/div><\/div><\/div>\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-5601we-aa5f09f01277242649b18e62d67b61cd\">\n.avia_transform .flex_column.av-5601we-aa5f09f01277242649b18e62d67b61cd{\nanimation-duration:1.5s;\n}\n<\/style>\n<div  class='flex_column av-5601we-aa5f09f01277242649b18e62d67b61cd av_one_full  avia-builder-el-6  el_after_av_one_full  el_before_av_one_full  first flex_column_div av-animated-generic fade-in-up  column-top-margin'     ><section  class='av_textblock_section av-lj439jrm-206335b72d0e5e146a8ae1472b1c1ccf '   itemscope=\"itemscope\" itemtype=\"https:\/\/schema.org\/CreativeWork\" ><div class='avia_textblock'  itemprop=\"text\" ><h2>Purpose<\/h2>\n<p>Mesutronic GmbH places great importance on the security of its products, services and information systems.<\/p>\n<p>This Coordinated Vulnerability Disclosure Policy describes the process for reporting, analysing, handling and disclosing security vulnerabilities. Its purpose is to minimise security risks for customers and users and to enable coordinated cooperation with security researchers and other reporters.<\/p>\n<\/div><\/section><\/div>\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-18ixkhq-7678a5d678f9e2cbebfe4fe66ea67f57\">\n.avia_transform .flex_column.av-18ixkhq-7678a5d678f9e2cbebfe4fe66ea67f57{\nanimation-duration:1.5s;\n}\n<\/style>\n<div  class='flex_column av-18ixkhq-7678a5d678f9e2cbebfe4fe66ea67f57 av_one_full  avia-builder-el-8  el_after_av_one_full  el_before_av_one_full  first flex_column_div av-animated-generic fade-in-up  column-top-margin'     ><section  class='av_textblock_section av-rctc8u-7ecc59ad8c3630c059963c6e7bd2e393 '   itemscope=\"itemscope\" itemtype=\"https:\/\/schema.org\/CreativeWork\" ><div class='avia_textblock'  itemprop=\"text\" ><h2>Scope<\/h2>\n<p>This policy applies to:<\/p>\n<ul>\n<li>Products of Mesutronic GmbH<\/li>\n<li>Software and firmware components<\/li>\n<li>Web applications operated by Mesutronic<\/li>\n<li>Digital services and systems under Mesutronic&#8217;s responsibility<\/li>\n<\/ul>\n<p>The following are excluded from this policy:<\/p>\n<ul>\n<li>Customer-owned systems and networks<\/li>\n<li>Third-party systems and services<\/li>\n<li>Social engineering attacks<\/li>\n<li>Physical attacks on devices or infrastructure<\/li>\n<li>Denial-of-Service (DoS) and Distributed Denial-of-Service (DDoS) attacks<\/li>\n<\/ul>\n<\/div><\/section><\/div>\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-368jxmm-a3f242ac3603b72926ae7ecfbd952cd7\">\n.avia_transform .flex_column.av-368jxmm-a3f242ac3603b72926ae7ecfbd952cd7{\nanimation-duration:1.5s;\n}\n<\/style>\n<div  class='flex_column av-368jxmm-a3f242ac3603b72926ae7ecfbd952cd7 av_one_full  avia-builder-el-10  el_after_av_one_full  el_before_av_one_full  first flex_column_div av-animated-generic fade-in-up  column-top-margin'     ><section  class='av_textblock_section av-lk85gyhm-3f879670e7b6a1779d190f2d95a6f390 '   itemscope=\"itemscope\" itemtype=\"https:\/\/schema.org\/CreativeWork\" ><div class='avia_textblock'  itemprop=\"text\" ><h2>Reporting Vulnerabilities<\/h2>\n<p>Security vulnerabilities can be reported to the Mesutronic PSIRT:<\/p>\n<p>Email: <a href=\"mailto:psirt@mesutronic.de\">psirt@mesutronic.de<\/a><\/p>\n<p>Where possible, please provide the following information:<\/p>\n<ul>\n<li>Affected product<\/li>\n<li>Product version<\/li>\n<li>Software or firmware version<\/li>\n<li>Description of the vulnerability<\/li>\n<li>Steps to reproduce the vulnerability<\/li>\n<li>Potential impact<\/li>\n<li>Available technical evidence<\/li>\n<li>Contact details for any follow-up questions<\/li>\n<\/ul>\n<\/div><\/section><\/div>\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-3gfdzjq-30533e3461eb4295d55a3fca9c0bd074\">\n.avia_transform .flex_column.av-3gfdzjq-30533e3461eb4295d55a3fca9c0bd074{\nanimation-duration:1.5s;\n}\n<\/style>\n<div  class='flex_column av-3gfdzjq-30533e3461eb4295d55a3fca9c0bd074 av_one_full  avia-builder-el-12  el_after_av_one_full  el_before_av_one_full  first flex_column_div av-animated-generic fade-in-up  column-top-margin'     ><section  class='av_textblock_section av-mu2f2q74-ba8d7083cba1fea1918ed547b5ff3175 '   itemscope=\"itemscope\" itemtype=\"https:\/\/schema.org\/CreativeWork\" ><div class='avia_textblock'  itemprop=\"text\" ><h2>Expectations for Reporters<\/h2>\n<p>Mesutronic supports responsible security research. We ask reporters to:<\/p>\n<ul>\n<li>Not access, modify or delete data without authorisation<\/li>\n<li>Not disrupt or manipulate systems<\/li>\n<li>Not use malware<\/li>\n<li>Not publicly disclose the vulnerability prior to coordinated disclosure<\/li>\n<li>Comply with all applicable laws and regulations<\/li>\n<li>Limit investigations to the minimum extent necessary<\/li>\n<\/ul>\n<\/div><\/section><\/div>\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-373lid2-04527f8718d68c3ceaeaaa4ed283c19a\">\n.avia_transform .flex_column.av-373lid2-04527f8718d68c3ceaeaaa4ed283c19a{\nanimation-duration:1.5s;\n}\n<\/style>\n<div  class='flex_column av-373lid2-04527f8718d68c3ceaeaaa4ed283c19a av_one_full  avia-builder-el-14  el_after_av_one_full  el_before_av_one_full  first flex_column_div av-animated-generic fade-in-up  column-top-margin'     ><section  class='av_textblock_section av-mu2f4n3v-e7df713a5df0a2feb056091bc05fa042 '   itemscope=\"itemscope\" itemtype=\"https:\/\/schema.org\/CreativeWork\" ><div class='avia_textblock'  itemprop=\"text\" ><h2>Handling of Reports<\/h2>\n<p>Upon receipt of a report, the following steps are taken:<\/p>\n<ul>\n<li>Registration of the report<\/li>\n<li>Technical analysis and validation<\/li>\n<li>Risk assessment<\/li>\n<li>Definition of appropriate countermeasures<\/li>\n<li>Implementation of corrective measures<\/li>\n<li>Communication with affected parties<\/li>\n<\/ul>\n<p>Mesutronic aims to meet the following target response times:<\/p>\n<ul>\n<li>Acknowledgement of receipt within 5 business days<\/li>\n<li>Initial assessment within 10 business days<\/li>\n<\/ul>\n<p>The complexity and criticality of a report may affect the time required for processing.<\/p>\n<\/div><\/section><\/div>\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-9qafti-06c7b97f8b5d3489a5fe01e71bb03d92\">\n.avia_transform .flex_column.av-9qafti-06c7b97f8b5d3489a5fe01e71bb03d92{\nanimation-duration:1.5s;\n}\n<\/style>\n<div  class='flex_column av-9qafti-06c7b97f8b5d3489a5fe01e71bb03d92 av_one_full  avia-builder-el-16  el_after_av_one_full  el_before_av_one_full  first flex_column_div av-animated-generic fade-in-up  column-top-margin'     ><section  class='av_textblock_section av-mu2f5q4m-2e3d4380e113dff619b9ff127c94d15c '   itemscope=\"itemscope\" itemtype=\"https:\/\/schema.org\/CreativeWork\" ><div class='avia_textblock'  itemprop=\"text\" ><h2>Coordinated Disclosure<\/h2>\n<p>Mesutronic follows the principle of Coordinated Vulnerability Disclosure (CVD).<\/p>\n<p>Information about confirmed vulnerabilities will generally only be published once:<\/p>\n<ul>\n<li>The analysis has been completed<\/li>\n<li>Appropriate measures are available, or<\/li>\n<li>Affected users can be adequately informed<\/li>\n<\/ul>\n<p>The timing and scope of any disclosure will be determined taking into account the risks to customers and users.<\/p>\n<\/div><\/section><\/div>\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-24bi5xy-215efcb2ba21515e5455c54e13239e7f\">\n.avia_transform .flex_column.av-24bi5xy-215efcb2ba21515e5455c54e13239e7f{\nanimation-duration:1.5s;\n}\n<\/style>\n<div  class='flex_column av-24bi5xy-215efcb2ba21515e5455c54e13239e7f av_one_full  avia-builder-el-18  el_after_av_one_full  el_before_av_one_full  first flex_column_div av-animated-generic fade-in-up  column-top-margin'     ><section  class='av_textblock_section av-mu2f758j-6c015f24628024b6fce12038efac3711 '   itemscope=\"itemscope\" itemtype=\"https:\/\/schema.org\/CreativeWork\" ><div class='avia_textblock'  itemprop=\"text\" ><h2>Security Advisories<\/h2>\n<p>In the event of confirmed vulnerabilities, Mesutronic may publish Security Advisories.<br \/>\nAn advisory may contain the following information:<\/p>\n<ul>\n<li>Description of the vulnerability<\/li>\n<li>Affected products and versions<\/li>\n<li>Risk assessment<\/li>\n<li>Recommended measures<\/li>\n<li>Available updates or workarounds<\/li>\n<li>Other relevant technical information<\/li>\n<\/ul>\n<\/div><\/section><\/div>\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-1pk92uu-a93aa743286c51aa31392c6fc75ae3ae\">\n.avia_transform .flex_column.av-1pk92uu-a93aa743286c51aa31392c6fc75ae3ae{\nanimation-duration:1.5s;\n}\n<\/style>\n<div  class='flex_column av-1pk92uu-a93aa743286c51aa31392c6fc75ae3ae av_one_full  avia-builder-el-20  el_after_av_one_full  el_before_av_one_full  first flex_column_div av-animated-generic fade-in-up  column-top-margin'     ><section  class='av_textblock_section av-mu2f83qf-412f5a4dd4635b5784d271fa9eac6451 '   itemscope=\"itemscope\" itemtype=\"https:\/\/schema.org\/CreativeWork\" ><div class='avia_textblock'  itemprop=\"text\" ><h2>Confidentiality and Data Protection<\/h2>\n<p>Information collected for the purpose of processing a vulnerability report will be treated confidentially.<\/p>\n<p>Personal data will only be processed to the extent necessary and in accordance with applicable data protection regulations.<\/p>\n<\/div><\/section><\/div>\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-4wbkuu-08e9c60ea9a0c2e7a3ccb91d61dec8b5\">\n.avia_transform .flex_column.av-4wbkuu-08e9c60ea9a0c2e7a3ccb91d61dec8b5{\nanimation-duration:1.5s;\n}\n<\/style>\n<div  class='flex_column av-4wbkuu-08e9c60ea9a0c2e7a3ccb91d61dec8b5 av_one_full  avia-builder-el-22  el_after_av_one_full  el_before_av_one_full  first flex_column_div av-animated-generic fade-in-up  column-top-margin'     ><section  class='av_textblock_section av-mu2f9buv-41edf09e217e5807f8f75bf6edfba132 '   itemscope=\"itemscope\" itemtype=\"https:\/\/schema.org\/CreativeWork\" ><div class='avia_textblock'  itemprop=\"text\" ><h2>Disclaimer<\/h2>\n<p>Submitting a vulnerability report does not create any entitlement to:<\/p>\n<ul>\n<li>Compensation<\/li>\n<li>Recognition<\/li>\n<li>Publication<\/li>\n<li>Specific response or processing times<\/li>\n<\/ul>\n<p>Mesutronic reserves the right to assess reports at its own discretion and to decide on further measures. This policy does not create any contractual rights or obligations.<\/p>\n<\/div><\/section><\/div>\n<style type=\"text\/css\" data-created_by=\"avia_inline_auto\" id=\"style-css-av-20b5h2-cf49bb61a3aefdc9410bc78ee518cc74\">\n.avia_transform .flex_column.av-20b5h2-cf49bb61a3aefdc9410bc78ee518cc74{\nanimation-duration:1.5s;\n}\n<\/style>\n<div  class='flex_column av-20b5h2-cf49bb61a3aefdc9410bc78ee518cc74 av_one_full  avia-builder-el-24  el_after_av_one_full  avia-builder-el-last  first flex_column_div av-animated-generic fade-in-up  column-top-margin'     ><section  class='av_textblock_section av-mu2fabhj-b07d10a1122221ca6fe3b76527e65d97 '   itemscope=\"itemscope\" itemtype=\"https:\/\/schema.org\/CreativeWork\" ><div class='avia_textblock'  itemprop=\"text\" ><h2>Contact<\/h2>\n<p>Product Security Incident Response Team (PSIRT)<br \/>\nMesutronic GmbH<\/p>\n<p>Email: <a href=\"mailto:psirt@mesutronic.de\">psirt@mesutronic.de<\/a><\/p>\n<\/div><\/section><\/div>\n\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":18,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-52662","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.mesutronic.de\/en\/wp-json\/wp\/v2\/pages\/52662","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mesutronic.de\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/www.mesutronic.de\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/www.mesutronic.de\/en\/wp-json\/wp\/v2\/users\/18"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mesutronic.de\/en\/wp-json\/wp\/v2\/comments?post=52662"}],"version-history":[{"count":6,"href":"https:\/\/www.mesutronic.de\/en\/wp-json\/wp\/v2\/pages\/52662\/revisions"}],"predecessor-version":[{"id":52765,"href":"https:\/\/www.mesutronic.de\/en\/wp-json\/wp\/v2\/pages\/52662\/revisions\/52765"}],"wp:attachment":[{"href":"https:\/\/www.mesutronic.de\/en\/wp-json\/wp\/v2\/media?parent=52662"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}