PSIRT – Vulnerability Disclosure Policy

If you make every effort in your research to comply with this Policy to the best of your knowledge and belief, we will consider your research authorized. We work with you to understand and solve the problem quickly.

“Research” in accordance with this Policy means activities in which you:

• Notify us as soon as possible after uncovering an actual or potential security problem

• Use exploits only to the extent necessary to confirm the existence of a vulnerability

• Give us a reasonable amount of time to resolve the problem before you make it public

• Do not submit a large volume of low-quality reports

WAGO does not limit the scope for products offered by WAGO, including hardware, software or components with digital elements. In the event of security vulnerabilities within our digital infrastructure, such as the WAGO website or any other type of service used by the company, please contact our Cyber Defense Center at the following email: cyberdefense@wago.com.

The information provided in this Policy is used exclusively for defensive purposes, i.e. to mitigate or eliminate vulnerabilities. Reports can be submitted anonymously. If you provide contact information, we will acknowledge receipt of your report. We support PGP encryption for email correspondence. The PGP key is accessible via our security.txt file. Please note that emails sent without PGP encryption may be ignored.

To help us classify and prioritize potential vulnerabilities, please include the following in your report if possible:

• Affected product or software version (item number, firmware version, etc.)

• A description of where the vulnerability was discovered and the potential impact of the exploit

• A detailed description of the steps required to replicate the vulnerability (proof-of-concept scripts or screenshots are helpful)

• If available: related documents concerning vulnerability (CVE, announcements, release notes, etc.)

• If possible, please write in English

If you wish to share your contact data with us, we promise to coordinate with you as openly and quickly as possible.

• We will confirm receipt of your report within one week.

• Our team will analyze the report in collaboration with the development team or partners responsible.

• We will inform you of the outcome of our investigation of your findings to the best of our knowledge and belief and explain the steps we take in the remediation process, including any problems or challenges that may delay a solution, as transparently as possible.

• We will work with you to create a CVE entry (provided by our coordination partner CERT@VDE) and to ensure you receive adequate recognition for supporting the security of our products.

• When we confirm the security vulnerability, we will inform our coordination partner cert@vde.

• We will publicly disclose the problems you report once a solution is available or published (whichever comes first). The vulnerability will be published in the form of a security advisory in accordance with the CSAF 2.0 standard.

• The vulnerability will be published through our coordination partner cert@vde.

• We will engage in an open dialog to address any questions.

Questions about this Policy can be sent to psirt@wago.com. We also invite you to contact us with suggestions for improving this Policy.