Signalement de vulnérabilité

Technology security and reliability are a core pillar of Gefran’s offer. The PSIRT (Product Security Incident Response Team) serves as the central body responsible for managing, analyzing, and promptly resolving potential security issues or vulnerabilities across our industrial products and solutions.

Through proactive monitoring and structured report management, Gefran ensures high protection standards, safeguarding customers’ operational continuity and the resilience of field systems.

The objective of the Gefran PSIRT is to ensure prompt handling, rigorous analysis, and effective mitigation of any potential issue affecting the hardware/software infrastructure of our products or provided automation solutions.

1. Submission Guidelines

The sole authorized channel for receiving reports is the dedicated form accessible from this portal. The process is open to anyone who identifies an anomaly (customers, system integrators, independent researchers, or external organizations) and is handled under strict confidentiality standards.

To allow our specialists to replicate the issue in a controlled environment, the report must include:

• Technical details of the defect: trigger mechanism, potential impact, and observed anomalous behavior.
• System identification: specific device model or application solution code.
• Version information: hardware revision, firmware release, or software version in use.

2. Evaluation and Remediation Lifecycle

Upon receiving the report, the PSIRT follows a tracked and structured workflow:

• Validation: verification of defect reproducibility and risk assessment.
• Technical involvement: engineering of the corrective measure (via firmware updates, software patches, or system reconfiguration guidelines).
• Feedback: direct communication with the reporter for technical clarifications and final resolution notification.

3. Disclosure and Regulatory Compliance

To protect the entire industrial ecosystem, resolutions are communicated in a coordinated and transparent manner to customers and the wider community through technical advisories and industry-standard platforms. Upon request and authorization, reporters can be credited for their contribution.

The operational model of the PSIRT directly aligns with the traceability and responsiveness mandates set by European cybersecurity regulations (such as the Cyber Resilience Act – CRA), driving continuous improvements in protection standards.

If a potential vulnerability is identified within Gefran products or solutions, reports can be submitted using the form “Report a Vulnerability”.

Vulnerability handling relies on transparent cooperation, based on the following mutual commitments:

Gefran’s Commitments:

• Traceability and Feedback: Formal acknowledgment and updates provided for every received report.
• Data Confidentiality: Information access restricted strictly to authorized personnel.
• Identity Protection: The reporter’s identity remains confidential unless public credit is explicitly requested.

Requirements for Reporters:

• Non-Disclosure: The reported vulnerability must not have been previously published.
• Information Quality: Submission of detailed, actionable, and reproducible technical data.
• Valid Contacts: Provision of reliable contact details for technical clarifications.
• Ethical Conduct: Adherence to responsible research practices, strictly avoiding exploitation, infrastructure attacks, or data tampering.

Vulnerability Disclosure
Certification IEC 62443-4-1