Cyber Security
Cyber-Security at RSF Elektronik
Cybersecurity is a core element of RSF Elektronik’s corporate philosophy and is firmly embedded in our processes. We regard the protection of our products, systems, and data as a continuous responsibility throughout the entire product lifecycle. A key component of our security approach is the responsible handling of potential vulnerabilities. The systematic identification, assessment, and remediation of vulnerabilities are integral parts of our security management framework.
Reporting Vulnerabilities
We expressly welcome collaboration with security researchers, customers, and other stakeholders. On this page, we provide clear information on how identified vulnerabilities can be reported in accordance with our Disclosure Policy. Our goal is to handle reported security vulnerabilities transparently, efficiently, and responsibly in order to continuously improve the security of our solutions.
Guideline –
Coordinated Vulnerability Disclosure (CVD) Policy
The security of RSF Elektronik products is our highest priority. We maintain a structured process for receiving, evaluating and handling security reports and work cooperatively with security researchers, customers, partners and other reporters. Compliance with legal and regulatory requirements, particularly the Cyber Resilience Act (CRA), and the continuous improvement of our cybersecurity measures are essential elements of our security management system. This policy explains how potential security vulnerabilities can be reported and how RSF Elektronik handles such reports.
This policy applies to
• all products developed, manufactured or provided by RSF Elektronik and to
• related software, firmware and digital components. Reports are accepted regardless of
whether the affected product is within or outside its normal product life cycle.
We welcome reports
• from security researchers,
• customers,
• suppliers,
• CERTs and CSIRTs,
• industry associations,
• authorities and
• other third parties.
No separate confidentiality agreement is required to submit a vulnerability report.
Security-related reports can be submitted to the following contact address:
E-Mail: cebqhpg-frphevgl@efs.ng
Please use the following subject line whenever possible:
„Security Vulnerability Report“
RSF Elektronik recognizes the importance of independent security research and will not initiate legal action against persons acting in good faith and complying with the following conditions:
• activities are limited to identifying and validating vulnerabilities;
• only the minimum activity required for verification is performed;
• no denial-of-service or availability-impacting actions;
• no social engineering; access to data only as necessary to demonstrate the vulnerability;
• no modification, deletion, publication or disclosure of data; privacy is respected;
• applicable laws are followed; support coordinated disclosure.
Please notify RSF Elektronik as early as possible about suspected or confirmed vulnerabilities:
• Treat vulnerabilities confidentially,
• delay publication until coordinated with RSF Elektronik,
• provide reproducible information and
• avoid unnecessary exploitation.
Information to Include in a Vulnerability Report Affected product or software:
• Including identification number and firmware/version,
• description of the vulnerability and potential impact,
• reproducible steps (PoC, scripts, screenshots, network data),
• whether the vulnerability is publicly known,
• related documents (CVE, notices, release notes),
• preferably in German or English.
7.1 Receipt:
RSF Elektronik will acknowledge receipt within a reasonable period.
7.2 Analysis:
The vulnerability is assessed for reproducibility, relevance and impact. Additional information may be requested.
7.3 Remediation:
If confirmed, appropriate mitigation and remediation measures are initiated.
7.4 Coordinated Disclosure:
Publication normally occurs only after
• a fix,
• update, or
• coordination with the reporter.
Security Advisories May include:
• description of the vulnerability,
• affected products and versions,
• workarounds and mitigation measures,
• and information about available updates/fixes.
This policy does not create any entitlement to compensation or participation in a bug bounty program.
Excluded are:
• general support requests,
• reports without security relevance,
• vulnerabilities in third-party products or systems not operated or controlled by RSF Elektronik, and
• automated mass reports without sufficient technical evidence.
All reports are handled confidentially and used solely for processing the reported vulnerability. Personal data is processed only to the extent necessary and in accordance with applicable data protection laws.
Contact for Vulnerability Reports
RSF Elektronik Ges.m.b.H. Product Security Team E-Mail: cebqhpg-frphevgl@efs.ng
“Together with security researchers, customers, and partners, we contribute to the continuous improvement of the cybersecurity of our products and systems.”
Contact
If you would like to report a vulnerability, require further information, or have any questions, please do not hesitate to contact us.