Vulnerability Disclosure

1. Vulnerability Disclosure Policy

imx Solutions GmbH places great importance on the security of its products, services, and digital systems. This policy describes the process for the responsible reporting, assessment, and remediation of security vulnerabilities, as well as our collaboration with security researchers, customers, and other individuals reporting potential security issues.

The purpose of this policy is to promote the coordinated disclosure of security vulnerabilities and to provide a transparent and legally compliant reporting process.

2. Scope

This policy applies to:

• all products with digital elements developed, provided, or operated by imx Solutions,
• associated software, firmware, and cloud components,
• publicly accessible systems and services where they are explicitly included within the scope of this policy.

Internal corporate systems, office IT, employee devices, supplier systems, and any other systems that have not been explicitly authorized for security testing are outside the scope of this policy.

3. Contact for Security Vulnerability Reports

Security vulnerabilities can be reported through the following channels:

• Email: psirt@imx-solutions.de

• Security.txt: https://www.imx-solutions.com/.well-known/security.txt

• PGP-Schlüssel: A15513FD1C41B4E776A1F3455DD686C560D0D94C

Where possible, vulnerability reports should include the following information:

• a description of the vulnerability,
• the affected product or component,
• the affected product version,
• steps to reproduce the vulnerability,
• expected and actual behavior,
• potential impact,
• a Proof of Concept (PoC), if available,
• contact details of the reporting person.

4. Commitments to Reporting Persons

imx Solutions GmbH supports responsible security research.

Where activities are conducted in accordance with this policy, do not intentionally cause harm, and comply with applicable laws, imx Solutions GmbH considers such activities to have been conducted in good faith and generally does not intend to initiate legal action against the reporting person.

If there is any uncertainty as to whether planned security research activities are permitted under this policy, we recommend contacting us in advance using one of the reporting channels listed above.

In addition, imx Solutions GmbH is committed to:

• treating security vulnerability reports confidentially,
• disclosing personal data of the reporting person only with their consent or where required by law,
• complying with the requirements of the General Data Protection Regulation (GDPR),
• acknowledging receipt of a vulnerability report within five business days.

5. Requirements for a Valid Vulnerability Report

A report will be considered a valid security vulnerability report if:

• the reported vulnerability affects products, services, or systems within the scope of this policy,
• the vulnerability is not publicly known at the time of reporting,
• the information provided is sufficient to allow reasonable assessment and reproduction of the vulnerability,
• the report does not consist solely of automatically generated scan results without meaningful analysis.

If a report is incomplete, the reporting person may be asked to provide additional information.

6. Rules of Conduct for Security Researchers

To minimize potential risks, the following principles must be observed:

• Vulnerabilities must only be investigated to the extent necessary to demonstrate their existence.
• Once the vulnerability has been successfully demonstrated, testing must cease without undue delay.
• Data must not be altered, deleted, manipulated, or disclosed without authorization.
• The availability of systems or services must not be impaired.
• Malware, exploits, or attack tools must not be distributed or made available.
• No activities may be carried out that could endanger customers or third parties.

7. Prohibited Testing Activities

The following activities are explicitly outside the scope of this policy:

• Social Engineering,
• Phishing,
• physical attacks against facilities or devices,
• Denial-of-Service (DoS) or Distributed Denial-of-Service (DDoS) testing,
• spam campaigns,
• attacks against systems outside the defined scope.

If any of these restrictions are inadvertently violated, imx Solutions GmbH must be informed without undue delay so that any potential impact can be jointly assessed and mitigated.

8. Handling of Vulnerability Reports

Upon receipt of a vulnerability report, it will be handled according to the following process:

Acknowledgement of Receipt

The reporting person will receive an acknowledgement of receipt within five business days.

Initial Assessment

An initial technical assessment will be performed within ten business days. This assessment will consider, in particular:

• the relevance of the report,
• reproducibility,
• potential impact,
• affected products and versions.

Further Communication

Additional information may be requested during the assessment and remediation process.
imx Solutions GmbH will make reasonable efforts to keep the reporting person informed about the progress of the investigation.

Closure

A vulnerability report may be considered closed, in particular, when:

• the report has been assessed as unfounded,
• the vulnerability has been remediated or appropriately mitigated,
• affected customers have been informed,
• a Security Advisory has been published.

The reporting person will be informed when the process has been concluded.

9. Coordinated Vulnerability Disclosure

imx Solutions GmbH supports the coordinated disclosure of security vulnerabilities.

Information about a vulnerability should generally not be made public until imx Solutions GmbH has had a reasonable opportunity to analyze the vulnerability, assess the associated risks, and provide appropriate remediation or mitigation measures.

Where possible, the timing and scope of any public disclosure will be coordinated with the reporting person.

10. Vulnerability Handling under the Cyber Resilience Act

Confirmed vulnerabilities are assessed, prioritized, documented, and addressed in accordance with our internal vulnerability management processes and applicable legal requirements.

Where required under the Cyber Resilience Act (Regulation (EU) 2024/2847), imx Solutions GmbH will report actively exploited vulnerabilities and severe incidents having an impact on the security of products with digital elements to the designated CSIRT and ENISA via the single reporting platform provided for under the Cyber Resilience Act.

For reportable actively exploited vulnerabilities and severe security incidents, imx Solutions GmbH follows the notification timelines and procedures set out in Article 14 of the Cyber Resilience Act, including the applicable early-warning, notification, and final-reporting requirements.

Where required, affected users will be informed about relevant vulnerabilities or incidents and about appropriate corrective or risk-mitigation measures.

11. Security Information and Advisories

imx Solutions GmbH may publish security information, Security Advisories, or other notices concerning vulnerabilities.

Where appropriate, imx Solutions GmbH may support or initiate the assignment of a CVE (Common Vulnerabilities and Exposures) identifier.

12. Changes to this Policy

imx Solutions GmbH reserves the right to amend this policy as necessary to reflect legal, technical, or organizational requirements.

The current version of this policy will be published on the imx Solutions website.