Cyber-Security

Security Throughout the Entire Product Lifecycle

The security of our products, software, and digital services is a central component of our approach to quality.

Our Commitment to Digital Security

Products with digital elements, networked systems, and digital services must be able to operate reliably, robustly, and securely. That is why we take security into account throughout the entire lifecycle of our products—from development through production and deployment to maintenance, updates, vulnerability management and communication.

Despite careful development, testing, and continuous improvement, security vulnerabilities cannot be completely ruled out. A structured and responsible approach to potential vulnerabilities is therefore crucial for identifying and assessing risks early on and providing appropriate protective measures.

On these pages, you will find key information on product security at Waldmann, on responsibly reporting potential vulnerabilities, as well as on current Security Advisories and recommended actions.

Cyber Resilience Act

The Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, establishes EU-wide cybersecurity requirements for products with digital elements. These requirements cover, among other things, secure product development, cybersecurity risk assessments, vulnerability handling, security updates, technical documentation, and support for products throughout their lifecycle.

The Regulation will apply in stages. The reporting obligations for certain actively exploited vulnerabilities and serious security incidents will apply from September 11, 2026. The key product-related requirements of the CRA will generally apply from December 11, 2027.

Waldmann takes these requirements into account as part of the ongoing development of its product security and vulnerability management processes.

Our Approach to Product Security

We view product security as a holistic and continuous process that accompanies products throughout their entire lifecycle. Cybersecurity is taken into account from the outset—from defining product and security requirements through development and verification, production and deployment, to operation, service, maintenance, and the controlled end-of-life of a product.

This includes the early assessment of potential cybersecurity risks, the implementation of appropriate security measures in architecture and development, the controlled integration of software and firmware components, and the documentation of relevant components and dependencies. Software Bills of Materials (SBOMs) support transparency regarding the software components used and facilitate the assessment of newly identified vulnerabilities.

Relevant security information and vulnerabilities continue to be monitored and assessed even after a product has been placed on the market. Where action is required, we analyze the potential impact on our products and initiate appropriate measures. These may include security updates, technical mitigations, information for customers and partners, or additional support measures provided as part of our service.

Report a Vulnerability

Have you discovered a potential security vulnerability in one of our products, a software component, a service, or a digital interface?

We welcome responsible security reports from security researchers, customers, partners, and users. Incoming reports are reviewed, assessed with regard to their potential impact, and handled as part of our vulnerability management process.

Please initially report vulnerabilities that are not yet publicly known confidentially to the email address below. For confidential information, our PGP key is also available.

Email: vulnerabilities@waldmann.com

PGP Key: Download PGP Key

Further information is available on our dedicated information page:
Report a Vulnerability

 

Security Advisories

If a confirmed vulnerability affects a Waldmann product, we assess appropriate corrective and risk mitigation measures. Depending on the individual case, these may include security updates, configuration changes, workarounds, or other protective measures.

We provide information on relevant remediated product vulnerabilities and required actions in our Security Advisories. These include information on the affected product and versions, the impact and severity of the vulnerability, as well as available updates, workarounds, or other recommended actions.

Security Advisories can also be accessed via RSS and in machine-readable CSAF format. Further information is available on our dedicated information page:

View Current Security Advisories

Security Support Throughout the Product Lifecycle

Cybersecurity does not end when a product is delivered. For products relevant under the CRA, information on the applicable security support period and available security updates will be provided through the relevant product documentation and support channels.

Please refer to the documentation, release notes, and Security Advisories applicable to your product and install security-related updates promptly.

Working Together for Greater Security

We value feedback from security researchers, customers, partners, and users that helps us further improve the security of our products and services. Coordinated collaboration helps address potential risks and protect users as effectively as possible.

Please do not publish technical details about potential vulnerabilities until you have consulted with us, and avoid any actions that could compromise systems, data, or operations.

Thank you for your support.

Security Contact

Email: vulnerabilities@waldmann.com

PGP Key: Download PGP Key

Phone: +49 7720 601 0

Contact Form: Web Contact Form

Mailing Address:
Herbert Waldmann GmbH & Co. KG
Peter-Henlein-Straße 5
78056 Villingen-Schwenningen
Germany

Last updated: August 2026
This policy is reviewed and updated on a regular basis and whenever there are significant changes to the regulatory or organizational framework.