Vulnerability Disclosure Policy
Vulnerability Disclosure Policy
How to report security vulnerabilities in Murrelektronik IT systems, websites, online shops and online services.
Murrelektronik takes reports of security vulnerabilities seriously and handles them in a coordinated way. This policy describes what can be reported, how a report is handled and which rules apply to both parties. Reports can be submitted in English or German.
Scope
This policy applies to all systems operated by Murrelektronik that are reachable from the internet, in particular:
- websites and online shops of Murrelektronik, in particular under murrelektronik.com, murrelektronik.de and my.murrelektronik.com as well as the online shops under shop.murrelektronik.* including country domains and subdomains
- customer portals and other online services of Murrelektronik
- IT infrastructure and cloud services operated by Murrelektronik
This policy is not an invitation to actively test Murrelektronik systems. Vulnerabilities in Murrelektronik products and solutions (hardware, firmware, software) are handled by the Product Security Incident Response Team (PSIRT).
Vulnerabilities in third-party services that Murrelektronik only uses, for example social media platforms, should be reported to the operator of that service.
Exclusions
The following are not handled under this policy:
- output of automated scanners without proof that the vulnerability is exploitable
- missing security headers as well as version or banner disclosures without demonstrated impact
- results of denial-of-service attacks, spam, social engineering or phishing directed at employees as well as of physical access
- reports that make compensation a condition
Reports go to cert@murrelektronik.de. A subject line starting with [SECURITY] speeds up triage. For encrypted submission, Murrelektronik agrees on a suitable channel on request. Reports can also be submitted anonymously. Follow-up questions and feedback require contact details.
Helpful information:
- affected system, service or address (URL)
- type of vulnerability and steps to reproduce
- date of discovery
- contact details for follow-up questions and feedback, optional
- Acknowledgment of receipt, usually within two business days.
- Review and assessment by the Information Security team, with follow-up questions if needed.
- Status information while remediation is in progress.
- Coordination of a possible publication date with the reporter. As a guide, publication is coordinated around 90 days after receipt of the report, depending on severity and complexity.
Murrelektronik asks reporters to:
- not access, modify or store third-party data beyond what is needed to demonstrate the vulnerability,
- not perform actions that impair systems or services, in particular no denial-of-service attacks, no social engineering and no physical access,
- keep findings confidential until the vulnerability has been remediated, a publication date has been agreed or 90 days after receipt of the report have passed,
- comply with applicable law.
Commitments of Murrelektronik
Murrelektronik commits to:
- take reports seriously and process them promptly,
- inform the reporter about the outcome and remediation.
Murrelektronik does not intend to pursue legal action against reporters who follow these guidelines, cause no harm and comply with applicable law.
Murrelektronik does not pay rewards for reports. Reporters are named in publications only with their consent.
Personal data voluntarily provided when reporting a security vulnerability (for example name, email address and the content of the report) is processed solely to handle the report and to communicate with the reporter. The processing is based on the legitimate interest of Murrelektronik in ensuring the security of its IT systems and online services pursuant to Article 6(1)(f) GDPR. Further information on the processing of personal data is available in the Murrelektronik privacy policy.
The contact details are available in machine-readable form according to RFC 9116 at https://my.murrelektronik.com/.well-known/security.txt.