This policy defines how Unitronics receives, evaluates, remediates, and discloses cybersecurity vulnerabilities affecting Unitronics products, firmware, software and supporting systems. The policy is aligned with the principles of the EU Cyber Resilience Act (CRA), ISO/IEC 29147, and ISO/IEC 30111.

The Unitronics PSIRT is responsible for receiving vulnerability reports, coordinating technical investigations, assessing severity, managing remediation activities, coordinating regulatory reporting, and overseeing customer communications.

Security vulnerabilities may be reported through the Unitronics support portal using the ‘Security Vulnerability’ category, through designated security contact channels, or through recognized CERT/CSIRT organizations. Reports should include affected product information, software or firmware versions, reproduction steps, impact details, and supporting evidence where available.

Reports are acknowledged, assigned a tracking identifier, reviewed for completeness, and evaluated for potential security impact. The PSIRT maintains communication with the reporting party throughout the investigation process.

Confirmed reports are assessed for exploitability, impact, customer exposure, and severity. Severity ratings are determined using CVSS and relevant product-specific considerations. Reports may be classified as confirmed vulnerabilities, duplicates, non-security issues, unsupported products, or insufficient information.

Unitronics performs root-cause analysis, develops corrective actions, validates fixes, and prepares updates or mitigations as appropriate. Remediation priorities are based on vulnerability severity, exploitability, customer impact, and regulatory obligations.

Unitronics works collaboratively with researchers, customers, CERTs, and other stakeholders to coordinate disclosure in a manner that minimizes customer risk.

Public disclosure is coordinated with the availability of mitigations, updates, or other protective measures whenever possible.

When disclosure is required, Unitronics publishes security advisories containing vulnerability descriptions, affected products and versions, severity information, available mitigations, and remediation guidance.

Where required under the EU Cyber Resilience Act (CRA), Unitronics reports actively exploited vulnerabilities and severe incidents having an impact on the security of products with digital elements through the CRA Single Reporting Platform (SRP), within the applicable regulatory timeframes.

Unitronics supports responsible security research. Researchers acting in good faith, avoiding customer harm, respecting privacy, and following this disclosure process are considered to be participating in a coordinated disclosure effort.

Vulnerability reports, assessments, remediation records, advisories, and related communications are retained in accordance with regulatory requirements and Unitronics record-retention practices.