Product Security

PSIRT – Product Security Incident Response Team

The Product Security Incident Response Team (PSIRT) of Christ Electronic Systems GmbH reviews and assesses security vulnerabilities in our products, coordinates their responsible disclosure and provides recommendations and security updates in the event of risks.

We handle reports according to established standards: assessment based on CVSS, coordinated disclosure and in line with the EU Cyber Resilience Act (CRA).

Contents

Scope

The scope covers all products with digital elements offered by Christ Electronic Systems GmbH. Please report vulnerabilities in these products as described below to our PSIRT.

If, on the other hand, a vulnerability affects our digital infrastructure – such as the website christ-es.com or other online services operated by us –, please contact the PSIRT of our corporate group: psirt@christ-es.de.

Report a vulnerability

Please report any vulnerabilities you discover in Christ Electronic Systems GmbH products by email to our PSIRT. An anonymous report is possible – if you provide contact details, we will confirm receipt.

Report a vulnerability

Please include

  • Product line and PA number (article number)
  • Affected or vulnerable version
  • Type of vulnerability — optionally with CWE ID and CVE ID
  • Description and, if possible, steps to reproduce (PoC)
  • Name of the organization (unless anonymous)
  • Email, phone and country
Coordinated Vulnerability Disclosure Policy

Full rules, process and detailed required information

What you can expect

  1. 1. Acknowledgement of receipt within 5 business days (provided contact details are given).
  2. 2. Detailed feedback on your report within 10 business days.
  3. 3. Analysis and assessment of the vulnerability based on CVSS – with assignment of a CVE ID where applicable.
  4. 4. We aim to remediate confirmed vulnerabilities within 90 days.
  5. 5. Publication of a security advisory once an update or mitigation is available.

Security Advisories

Current security advisories for our products. Each advisory states the affected products, the severity (CVSS) and recommended measures.

No security advisories at this time