These times apply from the moment we receive your report. If a fix takes longer, we will agree on a schedule with you.

(Further information)

Coordinated Vulnerability Disclosure Policy (CVD Policy)
Tebis Technische Informationssysteme AG

The security of our products and our customers is a high priority for us. Despite all our care, vulnerabilities cannot be ruled out entirely. We value the work of security researchers, customers and partners who make us aware of potential vulnerabilities, and we work with them to fix and disclose these responsibly.

This policy describes how to report vulnerabilities to us, what you can expect from us and which rules apply to coordinated disclosure. It also serves to implement the requirements of EU Regulation 2024/2847 (Cyber Resilience Act).

This policy applies to:

• Tebis CAD/CAM version 4.0 R9, version 4.1 and future releases, including associated components such as installers, license servers, updaters and interfaces
• Tebis ProLeiS
• online services and web applications provided by Tebis under tebis.com, tebis.cloud and their subdomains

We provide security updates only for the products and versions listed here.

Out of scope

• products or versions not listed above
• vulnerabilities in third-party software that do not affect Tebis products; please report these directly to the respective vendor
• results of automated scans without a demonstrable security impact
• social engineering, phishing or physical attacks on Tebis employees or premises
• denial-of-service testing against Tebis infrastructure

Send your report to security@tebis.com, or for Tebis ProLeiS alternatively to security@tebisproleis.com.

For sensitive details such as proof-of-concept code or exploit descriptions, please use our encrypted upload. Please also send us a short email without technical details so that we can match your upload to your report. We accept reports in English and German.

The following information is helpful:

• affected product and version(s)
• type of vulnerability and potential impact
• steps to reproduce, including a proof of concept if available
• your assessment of the severity, for example as a CVSS vector
• whether, to your knowledge, the vulnerability is already being actively exploited
• your contact details and whether you would like to be credited by name
• Incomplete reports are welcome too. We will contact you if we have questions.

We assess every report, inform you of the outcome and keep you updated on our progress. If a fix takes longer, we will agree on a schedule with you.

For confirmed vulnerabilities, we provide free security updates, inform affected customers and publish a security advisory on this page once the issue has been fixed. Where appropriate, we request a CVE identifier.

Please do not publish information about a vulnerability until a fix is available or 90 days have passed since your report, whichever comes first. We are happy to agree on the publication date with you.

If a vulnerability is demonstrably being actively exploited, we reserve the right to inform customers and publish protective measures earlier.

As a manufacturer, we are obliged under the Cyber Resilience Act to report actively exploited vulnerabilities and severe security incidents to the competent CSIRT and to ENISA. We comply with this obligation. We only share your personal data in this process if it is necessary or if you have consented.

You are also free to report vulnerabilities directly to the competent CSIRT; in Germany, this is the Federal Office for Information Security (BSI).

When conducting your research, please:

• go only as far as necessary to demonstrate the vulnerability
• do not access, modify, delete or store third-party data; if you obtain such data by accident, please delete it immediately and let us know
• do not disrupt systems or impair their availability
• do not install backdoors or maintain persistent access
• keep information about the vulnerability confidential until it is disclosed in a coordinated manner
• do not demand compensation as a condition for disclosure

If you act in good faith and in accordance with this policy, we will not take legal action against you or file a criminal complaint in connection with your report. This assurance applies only to claims by Tebis; we cannot rule out rights of third parties.

We currently do not offer a bug bounty program with financial rewards. With your consent, we are happy to credit you in the relevant security advisory.

We review this policy regularly and update it as needed, in particular the list of supported versions. The current version is published at www.tebis.com/en/security and in German at www.tebis.com/de/security. In case of discrepancies between the language versions, the German version shall prevail.

There are currently no published security advisories.