COORDINATED VULNERABILITY DISCLOSURE POLICY
Purpose
This Coordinated Vulnerability Disclosure (CVD) Policy defines how security researchers, customers, and partners can safely report potential vulnerabilities affecting LEM Products with Digital Elements (PDEs).
It also describes how LEM evaluates, validates, remediates, and discloses vulnerabilities in accordance with CRA (Cyber Resilience Act) Annex I, Part II, CRA Annex II, and international standards ISO/IEC 29147 (Vulnerability Disclosure) and ISO/IEC 30111 (Vulnerability Handling Processes).
This policy is consistent with the practices publicly described on the official LEM PSIRT (Product Security Incident Response Team) page, where LEM provides its product security reporting process and governance.
Scope of application
This policy applies to all LEM PDEs and their associated firmware, embedded software, connectivity modules, cloud backends, and digital components placed on the market by LEM, including vulnerabilities located in third-party or open-source components integrated in those products subject to CRA conformity requirements.
It applies to all vulnerability reports submitted by external researchers, customers, security analysts, and third-party partners via the official LEM PSIRT reporting channel.
How to Report a Vulnerability
Publication of PSIRT information
LEM publishes its official Product Security Incident Response Team (PSIRT) information on the public website at: https://www.lem.com/en/psirt
This page provides:
- Official vulnerability reporting instructions,
- Required PGP public key for encrypted submissions,
- Information required from reporters,
- LEM’s commitments regarding triage and communication,
- Descriptions of the PSIRT process and responsible disclosure expectations.
This public PSIRT page constitutes the authoritative external reference for vulnerability reporting and secure communication with LEM. All external reporters must use the PGP key and instructions provided on that page.
Single Point of Contact (mandatory under CRA Annex II)
LEM provides an official PSIRT reporting channel as required by CRA Annex II.
Email: productsecurity@lem.com
PGP Encryption: All reports must be encrypted using the LEM PSIRT public PGP key available on the LEM PSIRT webpage.
Reporters must also include their own PGP public key to enable secure encrypted responses from LEM.
By submitting a report, the reporter confirms they are authorized to do so and grants LEM the rights necessary to process the report for security evaluation, verification, remediation, documentation, and coordinated disclosure activities as described on the public PSIRT page.
Reports from recurring or trusted finders with a demonstrated history of accurate submissions may follow a streamlined triage and communication process.
Required information
To allow LEM to evaluate a report efficiently, please provide at least the following information:
- Product identification (model, part number, firmware/software version)
- Detailed description of the suspected vulnerability
- Method and date of discovery
- Known exploit details (if any)
- Steps to reproduce
- Any prior or planned public disclosure
- Reporter’s contact information
Missing information may prevent LEM from evaluating the report.
Safe Testing Guidelines
Security research must follow responsible practices and not cause service disruption or safety impact.
The following activities are strictly prohibited:
- Denial-of-Service testing (DoS/DDoS)
- Social engineering, phishing or vishing
- Attacks on third-party infrastructure
- Any action that causes data loss, privacy violations, or operational interruption Testing must cease immediately if unintended data exposure occurs.
LEM will not pursue legal action for good-faith, non-intrusive testing performed in line with these guidelines and CRA/ISO responsible disclosure principles.
LEM Vulnerability Handling Process
Identification & Triage
LEM PSIRT acknowledges receipt of the report and evaluates the potential vulnerability based on severity, exploitability, safety impact, regulatory relevance, and impacted PDE components. PSIRT may contact the reporter to request additional information as needed
Validation
LEM security engineers reproduce, verify, and confirm the issue, assessing its applicability across affected versions.
Remediation
LEM prioritizes remediation according to CRA severity requirements. Fixes and mitigations are developed, tested, and validated through LEM’s secure development lifecycle.
Wherever feasible, security updates are provided separately from functional updates, as required by CRA.
Coordinated Public Disclosure
LEM follows Coordinated Vulnerability Disclosure (CVD) practices and may apply a short embargo period before public disclosure to allow customers to deploy fixes safely, unless disclosure is required earlier by law or to protect users.
Disclosures include severity, impact, affected products, mitigation steps, and patch timelines.
Third-party and open-source components
Where a vulnerability affects a third-party or open-source component integrated in a LEM product, LEM reports the vulnerability to the entity manufacturing or maintaining that component and, where LEM has developed a fix, shares the relevant code or documentation with that entity, in accordance with CRA Article 13(6). LEM coordinates disclosure timing with upstream maintainers and other affected parties.
Communication Commitments
- Acknowledgment of receipt within 7 working days (encrypted using reporter’s PGP key).
- Initial status update within 14 days.
- Regular updates until remediation is delivered.
- Inclusion of PSIRT contact details in CRA‑required product documentation.
These commitments align with the public commitments described on the LEM PSIRT page.
With the reporter’s consent, LEM may acknowledge or credit the reporter in a security advisory or other vulnerability communication. LEM does not currently operate a public bug-bounty or monetary reward program.
Reporting to Authorities (CRA Article 14)
Where LEM becomes aware of an actively exploited vulnerability contained in a Product with Digital Elements, LEM shall notify it, via the CRA Single Reporting Platform, to the CSIRT designated as coordinator and ENISA, without undue delay and in any event within 24 hours. Unless the relevant information has already been provided, LEM shall submit the vulnerability notification within 72 hours and a final report no later than 14 days after a corrective or mitigating measure is available, in accordance with CRA Article 14.
Where appropriate, LEM may also coordinate with relevant national CSIRTs (Cyber Security Incident Response Team) in cases involving multi-vendor or broader ecosystem impacts.
Exclusions
This policy does not apply to:
- Physical attacks requiring specialized equipment
- Social engineering
- Attack scenarios requiring violation of law or third-party terms
- Testing on systems or infrastructure not owned or operated by LEM
- End of support products listed in LEM documentation
- Denial of Service testing or stress testing
Governance & Review
This policy is owned by the Group Head of Data & Cyber Security and reviewed annually or upon any CRA regulatory updates.
The PSIRT Lead is responsible for ensuring consistency between internal procedures and the public PSIRT page.
Updating Responsibilities
Responsibility for this document lies with the Information Systems Department & Quality Department of LEM and is carried out on an annual basis, except for any specific event that requires timely updating.
The Departments involved in the activities governed by this procedure are responsible for detecting corporate events of an operational nature which involve the need for updating. These findings must be reported immediately to the Information Systems Function to ensure coordination of document updating activities.