Coordinated vulnerability disclosure policy
At EAS we want to know as soon as possible any security vulnerabilities in our machines and controllers Atlantis PCT to correct them and protect our users. Here we explain how to communicate a possible failure in a responsible and coordinated manner, and what we commit to in return.
Report a vulnerabilityProducts included
This policy applies to the following machines and drivers, and the software that integrates them, during their support period.
1.How to report a vulnerability
Use our single point of contact for cybersecurity matters. To allow us to analyze the case quickly, please include the information provided.
All information received is treated confidentially and is managed in accordance with this policy.
- Affected machine
- Controller model Atlantis PCT
- Software, firmware or PLC version
- Detailed description of the vulnerability
- Steps to reproduce the problem
- Potential impact on system security, availability or integrity
- Available technical evidence (captures, records, proof of concept)
- Known mitigation measures
2.Our commitments
When we receive a report, at EAS we commit to:
Reply
Acknowledge receipt within a reasonable time and maintain an open channel of dialogue with the reporting party.
Evaluate and correct
Analyze the failure, determine its severity, and work on a correction.
Inform
Communicate to the person reporting the evolution and resolution of the case.
Protect
Do not take legal action against anyone who investigates and reports in good faith in accordance with this policy, without accessing other people's data beyond what is necessary or causing harm.
Recognize
Publicly thank the reporting person for their contribution, if they wish.
3.What we ask of whoever reports
To ensure that collaboration is safe for everyone, we ask that:
Act in good faith
Do not exploit the flaw beyond what is necessary to prove it, nor access, modify, or delete third-party data.
Maintain confidentiality
Do not publicly disclose the vulnerability until EAS has corrected it and a joint agreement is reached on when to make it public.
Respect the law
Comply with current legislation and respect privacy throughout the investigation.
4.Coordination and publication process
This is how we manage each vulnerability, from the moment we receive it until the solution reaches users.
Reception
We received the notification through the security channel and confirmed its receipt.
Analysis
EAS analyzes and classifies the failure according to its severity.
Correction
We develop and validate the security update.
Coordinated publication
With the fix available, we report the vulnerability fixed and make the update available to users. Publication may be postponed if disclosing it poses more risk than benefit, until users can apply the patch.
Official notification
If the vulnerability is being actively exploited or constitutes a serious incident, EAS will also notify CSIRT and ENISA, in accordance with Article 14 of Regulation (EU) 2024/2847, and notify affected users.
Annex 1 · Vulnerability report
Copy this structure to your email at security@escarre.com.
| Field | What to indicate |
|---|---|
| Contact information | Name, company (if applicable), email and telephone. |
| Affected machine | TecnoMix, TecnoDos or TecnoSal (and serial number, if you know it). |
| Controller Atlantis PCT | PCT-300, PCT-310, PCT-315, PCT-320 or PCT-925. |
| Version | Software, firmware or PLC version. |
| Description | Detailed explanation of the vulnerability. |
| Steps to reproduce it | Sequence of actions necessary to reproduce the problem. |
| Potential impact | Effect on system security, availability or integrity. |
| Evidence | Captures, logs (logs) or proof of concept. |
| Mitigation | Known temporary measures to reduce risk. |
| Public recognition | Please indicate if you wish to appear as the author of the report (Yes / No). |
Have you detected a possible security flaw?
Write to us. The sooner we know, the sooner we can protect all users.
security@escarre.com