PRODUCT SECURITY

Report a security incident

Use this form to report actively exploited product vulnerabilities and serious security incidents relating to ErvoCom products.

CVD Policy: Under the CVD Policy, a report must refer to a specific product and identify the integrator or system context. Relevant report information may be shared with the integrator for the joint assessment.

Do not include unnecessary personal data, credentials or detailed information about protected infrastructure. For sensitive evidence, logs, PCAPs or PoC files, we will coordinate an appropriate transfer method after receipt.

1. Report type

Report type * Classification according to CVD Policy section 3.1. If unsure, select “Unclear”.

Short title / summary *

Discovery / first observed date

Is there evidence of active exploitation? * Yes No Unknown

2. Affected product

Product / model *

Software / firmware version *

Hardware revision

Serial number / project or vehicle reference Provide only if necessary for identification. Do not include unnecessary customer data.

3. Integrator & system context

Integrator / system owner * Name the integrator. If unknown, identify the system owner/operator (CVD Policy 6.2/6.6).

Operator / end customer

Country of predominant operation * For mobile infrastructure, such as rail vehicles, provide the country of predominant operation. No exact location is required.

System context / integration * How is the ErvoCom product integrated? Which interfaces, peer systems or functions are relevant?

4. Technical details

Incident / vulnerability description *

Potential or observed impact *

Severity classification * Critical High Medium Low Unknown

Are supporting files or evidence available? * Yes No

Reproduction / observation steps *

Preconditions / required access

Protection or containment measures already taken

5. Reporter

Name

Organisation

Role

Email Optional but recommended so we can coordinate follow-up questions and secure file transfer.

Phone

6. Confirmations

I confirm that this report has a specific relationship to an ErvoCom product and its integrator/system context and is not an unverified bulk report. *

I confirm that I did not actively exploit the vulnerability, attack ErvoCom or customer infrastructure, or offer exploit tools to third parties for carrying out attacks. *

To the best of my knowledge, this is not a report of an already published vulnerability. *

I have read and acknowledge the rules described in the CVD Policy. CVD Policy *

I have read the Privacy Policy. Privacy Policy *