Product Safety

1. EMH metering PSIRT – Product Security Incident Response Team

The EMH metering PSIRT is a team at EMH metering GmbH & Co. KG tasked with managing the investigation and disclosure of product security incidents, cybersecurity incidents and vulnerabilities regarding EMH metering products. The EMH metering PSIRT coordinates and maintains communication with everyone involved, both in-house and externally, to implement an appropriate response for any identified security problems.

2. Why should you report incidents and vulnerabilities?

Disclosing incidents and vulnerabilities enables us to investigate and fix the underlying issues and inform customers who are using the products in question about the fix. This approach can help us to keep making our products more secure, and above all to support EMH metering customers in managing security risks.

3. Reporting of a general product safety incident

EMH metering products fulfil the applicable normative and legal safety standards on delivery. If you believe that a potential product safety incident (e.g. risk of personal injury or property damage) has occurred on your EMH metering GmbH & Co. KG device, you can report this incident to us using the form below.
Reports without sufficient information cannot be processed.
Pictures of the product with the alleged defect and the installation situation are helpful for the assessment of your report.
Information about the product can be found on the product itself, on the packaging or in the instructions for use.

3.1 How can you report a security incident or vulnerability in an EMH metering product?

You have the following options:

• Via e-mail to psirt@emh-metering.com
• Via the web-based form provided below

Please include the following information in your report:

• Subject: General product security incident
• Affected product and variant
• Affected serial numbers (if available)
• Proof of vulnerability (if available)
• Your name / name of organization
• E-mail
• Telephone
• Country

4. Reporting of a cybersecurity incident

4.1 How can you report a security incident or vulnerability in an EMH metering product?

You have the following options:

• Via e-mail to psirt@emh-metering.com, encrypted via SMIME using our public key provided here
• Via the web-based form provided below

Please include the following information in your report:

• Subject: Cybersecurity incident
• Affected product and variant
• Vulnerable version
• Details on vulnerability and how to exploit it (including CWE-ID, CVE-ID if available)
• Proof of vulnerability (if available)
• Your name / name of organization
• E-mail
• Telephone
• Country

4.2 What will we do with your report?

The information you provide will be handled by the EMH metering PSIRT. No unauthorized employees or external users will be able to access the information you send us.
EMH metering will also ensure that your identity and contact details are kept confidential and not published in public statements (advisories and bulletins) unless explicitly requested by you.
The EMH metering PSIRT will contact you via your e-mail address in the following situations:
NOTE: Depending on the severity of the vulnerability, EMH metering might only be able to share sensitive information with you via an encrypted communication channel.

• The EMH metering PSIRT will ask for more information if the information you provided on the vulnerability or exploit is insufficient for verifying it
  NOTE: Failure to provide required information upon request might force EMH metering to discard your report
• The EMH metering PSIRT will inform you once the vulnerability is verified
• The EMH metering PSIRT will inform you once the handling of your report is finished and why

4.3 How can you send us an anonymous report?

You can use the web-based form and omit your contact information. However, if you did not provide contact details with your initial report, EMH metering will not be able to contact you, which might inhibit EMH metering’s ability to verify the vulnerability. EMH metering will still try to analyze and remediate the vulnerability.

5. Stay informed

EMH metering product security advisories are found here.