Coordinated Vulnerability Disclosure Policy

Traeger GmbH Industry Components (hereinafter “Traeger”) is a manufacturer of industrial software solutions. The security of our products is our highest priority.

This policy describes how security researchers, customers, and third parties can report a possible vulnerability in our products, how we handle such reports, and under what conditions coordinated publication takes place.

We follow the recommendations of ISO/IEC 29147:2018 (Vulnerability Disclosure), the BSI (BSI-CS_019), and the FIRST PSIRT Services Framework. This policy is part of our CRA compliance under the EU regulation on horizontal cybersecurity requirements (Cyber Resilience Act).

Scope

Included

All software products actively distributed by Traeger, in their respective current versions as well as the versions falling within the support period.

Excluded

• The traeger.de website and all associated web services (e.g. docs.traeger.de, share.traeger.de). For vulnerabilities in our web infrastructure, please contact info@traeger.de.
• Products that have reached their end of life within the meaning of our CRA compliance and are no longer actively distributed.
• Third-party software included in our products (e.g. open-source libraries). We nevertheless accept vulnerabilities in these components and forward them to the respective upstream maintainer where applicable.

Please send security reports exclusively to our PSIRT channel. It is separate from our general customer support, so that security reports reach the right people immediately.

Contents of a vulnerability report

A meaningful report helps us assess and remediate the vulnerability quickly. Where possible, we ask you to provide the following information:

• Affected product and version (e.g. Opc.UaFx.Advanced 2.51.4.0)
• Description of the vulnerability and its possible impact
• Steps to reproduce or a proof of concept
• Your own assessment of the severity (e.g. CVSS score)
• Your contact details for follow-up questions (email is sufficient)
• Whether you would like to be named as the reporter when a Security Advisory is published or wish to remain anonymous

Reports that do not contain all of this information will of course still be processed.

Processing procedure

After your report is received, it goes through the following steps:

1. Acknowledgment of receipt — We confirm receipt of your report within the initial response target times stated below.
2. Assessment — We assess the vulnerability according to CVSS v3.1 and assign it a severity level (Critical, High, Medium, Low).
3. Remediation — We develop a fix or workaround and provide it within the target times stated below.
4. Communication — During processing, we keep you informed of the status, from the initial assessment through the development of the fix to publication.
5. Publication — Once the fix is available, we publish a Security Advisory (see Section 7).

Response times

The following target times apply from receipt of the report:

We practice Coordinated Vulnerability Disclosure. This means:

• Embargo period — After a report is received, an embargo period of 90 days begins. During this period, we ask the reporter not to make any information about the vulnerability public.
• Publication by Traeger — We publish a Security Advisory as soon as a fix or a workaround is available — ideally before the end of the embargo period.
• Publication by the reporter — After the 90 days have elapsed, the reporter is free to disclose the vulnerability — regardless of whether a fix is available. In this case, we ask for prior coordination so that we can align the publication of our advisory.
• Exception in case of active exploitation — For vulnerabilities with a severity of Critical (CVSS ≥ 9.0), we actively check during the assessment whether there are indications of exploitation. In doing so, we also take the reporter’s assessment into account. If such indications exist, the embargo is waived in favor of immediate notification of affected customers and reporting to the authorities pursuant to Section 11. In this case, we inform the reporter in advance.
• Acknowledgment of the reporter — On request, we name the reporter by name in the published advisory. By default, acknowledgment is anonymous (“With thanks to a responsible reporter”). The decision rests with the reporter.

Safe Harbor — waiver of legal claims

Traeger refrains from taking legal action against persons who report vulnerabilities in our products under this policy, provided the following conditions are met:

• The report is made in good faith and with the aim of improving the security of our products.
• The reporter has not gained unauthorized access to, copied, altered, or disclosed the personal data of third parties.
• The reporter has not impaired the availability of our systems or the systems of our customers (e.g. through denial-of-service testing).
• The reporter has not made the vulnerability public before Traeger had the opportunity to provide a fix or the embargo period has elapsed.
• The reporter has not used the vulnerability for extortion, coercion, or other unlawful purposes.

This waiver extends to claims under criminal law (§§ 202a–202c StGB), copyright law (UrhG), and the Trade Secrets Act (GeschGehG), insofar as the above conditions are met.

Reverse engineering and decompilation

Security research may require the analysis of binary files. For analyses that serve solely to identify security vulnerabilities and whose results are reported to us under this policy, we assert no claims under §§ 69c, 69e UrhG (prohibition of decompilation) or the Trade Secrets Act.

The prerequisite is that the analysis remains limited to what is necessary to identify the vulnerability and that findings obtained are not used for any purpose other than reporting the vulnerability.

Coordination with third parties

Our products integrate third-party components, including open-source libraries and OPC Foundation specifications. If a reported vulnerability affects such a third-party component, we coordinate disclosure with the respective upstream maintainer or the responsible organization.

In such cases, the embargo period may be extended, as remediation depends on the cooperation of third parties. We inform the reporter about the involvement of third parties and the adjusted schedule.

As a manufacturer, since 11 September 2026 we have been subject to the reporting obligations of the EU Cyber Resilience Act. This means:

No bug bounty program

Traeger does not run a bug bounty program and does not pay financial incentives for vulnerability reports. We value the contributions of security researchers and offer, on request, a named acknowledgment in the published Security Advisory.

Data protection

Personal data collected in the course of a vulnerability report (in particular the reporter’s name and email address) is processed by us exclusively for the purpose of handling the report and communicating with the reporter. Processing is carried out on the basis of Art. 6(1)(f) GDPR (legitimate interest in product security).

Reporter data is not passed on to third parties unless this is necessary for coordination with upstream maintainers and the reporter has consented. The data is deleted as soon as the handling of the report and the publication of the advisory are complete, but at the latest after 24 months.

Should a reporter feel that their report is not being handled appropriately, they are free to involve the Federal Office for Information Security (BSI) as a mediator. The BSI offers a coordination service for cases in which direct communication between reporter and manufacturer does not lead to the desired outcome.

Notices about our products

For security researchers who analyze the behavior of our products, the following context is relevant:

• Our products do not “phone home”. There is no telemetry, no analytics endpoint, and no automatic update check to Traeger servers.
• Security patches are provided as a revision increment (Major.Minor.Build.Revision). A change in the fourth version segment denotes a targeted fix without functional changes.
• SBOM data in SPDX 2.3 format is part of every product download and can be used to identify affected third-party components.

Exclusions

The following activities are not covered by the protection of this policy and are not recognized by us as a coordinated vulnerability report:

• Penetration testing against production systems of Traeger customers without their explicit consent
• Social engineering against Traeger employees or their customers
• Denial-of-service attacks of any kind
• Access to, copying of, or alteration of the personal data of third parties
• Extortion or coercion in connection with a vulnerability report
• Public discussion or disclosure of a vulnerability before the end of the embargo period or before coordination with Traeger

Validity and amendments

This policy takes effect upon its publication at
https://www.traeger.de/security/cvd-policy.

Traeger reserves the right to update the policy at any time. Amendments are published at the same URL and marked with an updated version date. The respective current version is referenced at /.well-known/security.txt.

For reports received before an amendment to the policy, the version valid at the time of the report applies.

Contact