Cyber Resilience Act

Reporting cybersecurity vulnerabilities and incidents

 

Euronda S.p.A. places particular importance on the security of its products and on the timely identification and handling of potential cybersecurity vulnerabilities. 

In accordance with Regulation (EU) 2024/2847 – the Cyber Resilience Act (CRA) – Euronda has established a dedicated point of contact through which customers, distributors, users, security researchers and other interested parties may report cybersecurity vulnerabilities or incidents concerning Euronda products with digital elements that are subject to the CRA. 

 

What to report

This channel may be used to report, for example: 

  • identified or suspected security vulnerabilities; 
  • potential unauthorised access to or use of a product’s digital functionalities; 
  • abnormal behaviour that could compromise product security; 
  • incidents that could affect the availability, authenticity, integrity or confidentiality of data or functions; 
  • evidence of potential exploitation of a vulnerability.

 

How to submit a report

Reports may be submitted to the following Euronda point of contact: 

Email: ot-security@euronda.com 

Alternatively, Euronda S.p.A. may be contacted by telephone at: 

Tel. +39 0444 656111 

To enable a timely assessment, please provide the following information, where available: 

  • name and model of the product concerned; 
  • product code and/or serial number; 
  • software or firmware version, if available; 
  • description of the vulnerability or incident; 
  • how the issue was identified and, where possible, instructions for reproducing it; 
  • any technical evidence, logs, images or other useful supporting information; 
  • any measures already taken to contain the issue; 
  • the reporting party’s email address and telephone number, should they wish to be contacted for further information. 

Please do not submit personal data or confidential information that is not strictly necessary to assess the report. 

 

Handling of reports

Reports received are recorded and assessed by the relevant Euronda departments. 

Depending on the nature and significance of the report, Euronda will: 

  • verify and technically assess the vulnerability or incident; 
  • determine any potential impact on the security of the products concerned; 
  • identify the necessary containment, mitigation or corrective measures; 
  • prepare security updates or other corrective measures, where necessary; 
  • inform affected users where required or appropriate; 
  • submit the notifications required under the Cyber Resilience Act to the competent authorities through the applicable official channels.

 

Coordinated Vulnerability Disclosure 

Euronda follows a coordinated vulnerability disclosure (CVD) approach. 

We therefore ask reporting parties to refrain from publicly disclosing technical details of vulnerabilities that have not yet been remediated until Euronda has had a reasonable amount of time to analyse them and prepare any appropriate mitigation or corrective measures. 

Euronda undertakes to handle reports in good faith, restrict access to the information to those involved in its assessment and, where possible, maintain communication with the reporting party throughout the analysis and handling process. 

 

Reports unrelated to cybersecurity

This channel is intended exclusively for reports concerning the cybersecurity of Euronda products. 

For technical support requests, commercial or product complaints, reports concerning medical devices, privacy, accessibility or whistleblowing, please use the relevant existing Euronda contact channels.