Cybersecurity at Yunex Traffic

We are prepared to work in good faith with individuals that submit vulnerability reports via the channels described in section “Contact Information”. We openly accept reports for currently listed Yunex Traffic products, solutions, and Yunex Traffic IT infrastructure. We credit individuals that ethically report security issues in Yunex Traffic‘ product, solutions, services, or infrastructure. However, we do not intend to engage in legal action against individuals who:

• Engage in testing of systems/research without harming anyone.
• Test on products without affecting customers, or receive permission/consent from customers before engaging in vulnerability testing against their devices/software, etc.
• Adhere to the applicable laws.
• Perform coordinated disclosure, i.e., refrain from disclosing vulnerability details to the public before a mutually agreed-upon timeframe expires.
• Avoid impact to the safety or privacy of anyone.

1. Report

To report a security vulnerability affecting a Yunex Traffic product, solution or infrastructure component, please contact Yunex Traffic using the channels described in section Compliance (or see „Cybersecurity contact“ below). Yunex Traffic usually responds to incoming reports within one to two business days (reference: Munich, Germany).

Please report the following information:

• Description of vulnerability, including proof-of-concept exploit code or network traces (if available)
• Affected product, solution or infrastructure component, including model and firmware version (if available)
• Publicity of vulnerability (was it already publicly disclosed?)

Everyone is encouraged to report discovered vulnerabilities, regardless of service contracts or product lifecycle status. Yunex Traffic welcomes vulnerability reports from researchers, industry groups, CERTs, partners and any other source as Yunex Traffic does not require a nondisclosure-agreement as a prerequisite for receiving reports. Yunex Traffic respects the interests of the reporting party (also anonymous reports if requested) and agrees to handle any vulnerability that is reasonably believed to be related to Yunex Traffic products, solutions or infrastructure components. Yunex Traffic urges reporting parties to perform a coordinated disclosure, as immediate public disclosure causes a ‘0-day situation’ which puts Yunex Traffic’ customer systems at unnecessary risk. Those systems comprise significant parts of the worldwide critical infrastructure.

2. Analysis

Yunex Traffic investigates and reproduces the vulnerability. If needed, Yunex Traffic will request more information from the reporter.

3. Handling

Yunex Traffic performs internal vulnerability handling in collaboration with the responsible development groups. National and Governmental CERTs having a partnership with Siemens ProductCERT may be notified about a security issue in advance. During this time, regular communication is maintained between Yunex Traffic and the reporting party to inform about the status and to ensure that the vendor’s position is understood by the reporting party. If available, pre-releases of software fixes may be provided to the reporting party for verification.

4. Disclosure

After the issue was successfully analysed and if a fix is necessary to cope with the vulnerability, corresponding fixes will be developed and prepared for distribution. Yunex Traffic will use existing customer notification processes to manage the release of patches, which may include direct customer notification, or public release of a security advisory containing all necessary information on the Yunex Traffic website.