{"id":3990,"date":"2023-03-14T11:02:20","date_gmt":"2023-03-14T10:02:20","guid":{"rendered":"https:\/\/www.icotec-medical.com\/cvd"},"modified":"2023-03-24T09:43:09","modified_gmt":"2023-03-24T08:43:09","slug":"coordinated-vulnerability-disclosure","status":"publish","type":"page","link":"https:\/\/www.icotec-medical.com\/en\/coordinated-vulnerability-disclosure\/","title":{"rendered":"CVD"},"content":{"rendered":"\n
<\/div>
<\/div><\/div>
\n

General Conditions and Rules:
How to Submit a CVD Report to Us<\/h2>\n\n\n\n
    \n
  • Fill out the form below with the details of your discovery.<\/li>\n\n\n\n
  • Provide as much information as possible so that the vulnerability can be reproduced. This can speed up the process.<\/li>\n\n\n\n
  • For more complex vulnerabilities, a direct exchange with you may be required. Provide us with at least an e-mail address or phone number.<\/li>\n<\/ul>\n\n\n\n

    Report Vulnerabilities<\/h2>\n\n\n\n
      \n
    • Only discuss the discovered security vulnerability during the CVD process with the responsible persons at icotec ag.<\/li>\n\n\n\n
    • Do not make the vulnerability public before the affected parties have had sufficient time to fix the problem.<\/li>\n\n\n\n
    • Do not repeatedly interact with the system after a vulnerability report during the CVD process.<\/li>\n\n\n\n
    • Do not use vulnerabilities beyond what is necessary for a proof of concept to download, modify, or delete data.<\/li>\n\n\n\n
    • Do not attempt to elevate privileges or explore a system beyond what is necessary for a proof of concept.<\/li>\n\n\n\n
    • Do not exfiltrate other users’ data, test only with your own data.<\/li>\n\n\n\n
    • Do not attempt to gain access to a system using brute force or social engineering techniques.<\/li>\n\n\n\n
    • Do not use denial of service attacks.<\/li>\n\n\n\n
    • Do not install malware or viruses.<\/li>\n\n\n\n
    • If possible, include in your report which IP addresses you used when discovering the vulnerability so that potential exploits can be better assessed and false positives reduced.<\/li>\n\n\n\n
    • Let the affected party know if you plan to make your findings public (report, presentation, article, etc.).<\/li>\n<\/ul>\n\n\n\n

      What You Can Expect from Our CVD Program<\/h2>\n\n\n\n
        \n
      • If a vulnerability relating to icotec’s systems is reported within the above rules and in good faith without fraudulent or damaging intent, icotec will not take any civil or criminal action against you.<\/li>\n\n\n\n
      • You can submit your report anonymously.<\/li>\n\n\n\n
      • icotec ag treats reports confidentially and only discloses personal data of the reporting parties or the recipient organization with their consent.<\/li>\n\n\n\n
      • We will only name you as the person reporting a vulnerability with your consent.<\/li>\n\n\n\n
      • You will receive an acknowledgement of receipt within 3 working days of reporting the problem.<\/li>\n\n\n\n
      • icotec ag will keep the reporting party informed about the further development and the elimination of the vulnerability as far as possible.<\/li>\n\n\n\n
      • icotec\u2019s CVD program does not currently offer compensation for notifications.<\/li>\n<\/ul>\n\n\n