CVD Policy

Coordinated Vulnerability Disclosure (CVD)

Warmup has provided a place for individuals or organisations to responsibly disclose a vulnerability that they have found in any Warmup products with digital elements. The full CVD Process is described transparently on this page, from the moment of reporting to the resolution of the vulnerability, where Warmup works to develop a solution to the vulnerability.

At Warmup we value the use of a Coordinated Vulnerability Disclosure process in improving the security of our devices. This Coordinated Vulnerability Disclosure (CVD) Policy outlines our structured process for reporting potential vulnerabilities to us safely and securely.

Note: Disclosures to Warmup’s CVD Process must focus on Warmup Wi-Fi connected devices and associated applications only.

Scope

Warmup Products with digital elements in scope of the Cyber Resilience Act (CRA) to which our
CVD process applies:

Connected Products	Related Services
Warmup 7iE	MyHeating App
Warmup Element	MyWarmup Portal
Warmup 6iE mini	Server

Definitions

Vendor: Warmup, the organisation that created or maintains the product that is vulnerable and will take remediation action.

Finder: Individual or organisation who has found a potential vulnerability.

Actively Exploited Vulnerability: A vulnerability for which there is reliable evidence that a malicious actor has exploited it in a system without permission of the system owner.

Incident: An incident that negatively affects or is capable of negatively affecting the ability of a product with digital elements to protect the availability, authenticity, integrity or confidentiality of data or functions.

Severe Incident: An incident that negatively affects the availability, authenticity, integrity or confidentiality of sensitive or important data or functions or leads to the introduction of malicious code.

CVD process

This section describes the CVD process, from submission of the vulnerability report to its resolution.

Once a valid vulnerability report is submitted by a Finder, the Finder will receive an acknowledgement email from Warmup that their report has been received.
Next, Warmup will assess the vulnerability report. The vulnerability is assessed, and either accepted or rejected as to its validity. In either case, the Finder is notified.
If the vulnerability report is assessed as valid, Warmup will begin work to create a resolution. The resolution is prepared and adopted, and the Finder is informed by email of what the resolution is and that it has been made.
Warmup aims to resolve all valid vulnerabilities within 90 days of reporting though it may take longer for complicated fixes.

CVD Legal Notice

As the Warmup Coordinated Vulnerability Disclosure (CVD) Process is designed to benefit the security of Warmup products, Warmup does not warrant or assume any liability for the responsibilities of this process, or “Vulnerability Resolution” outcomes, and any other activities or milestones set forth by Warmup. Each beneficiary of this activity will engage in this offering without reliance or any representation and /or warranty of the other parties and all such representations and/or warranties are, to the greatest extent permitted by applicable law, hereby disclaimed.

The vulnerability will be handled in accordance with the Warmup CVD Process. Disclosures to Warmup’s CVD Process must focus on Warmup Wi-Fi connected products and associated applications. Disclosures outside of this scope will not be addressed by Warmup.

Disclosures to the Warmup CVD Process will not generate any financial compensation for the Finder.

Finder Responsibilities

When submitting a vulnerability report, the Finder (individual or organisation who has found a potential vulnerability) commits to:

Only share findings with Warmup using the vulnerability report form.
Provide a Proof-of-Concept and/or sufficient information to enable reproduction of the vulnerability. This allows the vulnerability report to be verified and allows possible fixes to be proposed.
Submit vulnerabilities pertaining only to Warmup Wi-Fi connected products and associated applications.

Warmup also requests that the Finder undertakes not to disclose the vulnerability with other people until it has been resolved by Warmup, not to use the vulnerability for exploitation beyond the minimum necessary to demonstrate the vulnerability to Warmup, and not to leverage the vulnerability for financial gain. As far as possible, these resolutions will happen within 90 days, when the vulnerability has been assessed as valid, in accordance with Warmup’s CVD process timeframes.

Warmup Responsibilities

Warmup will:

Treat submitted reports confidentially. Warmup will not share the Finder’s details with third parties without the Finder’s authorisation. However, if the vulnerability constitutes an actively exploited vulnerability or a severe incident, we are obliged under the CRA to report it to the relevant EU national authorities (e.g., ENISA, CSIRTs) within 24 hours of becoming aware of it.

Accept reports from anonymous Finders. However, Finders engaging anonymously accept that Warmup may be unable to contact them on topics concerning but not limited to: the vulnerability, progress towards resolution of the vulnerability, publication of the vulnerability.

Acknowledge the vulnerability report submitted by the Finder within 7 days of its submission, if the Finder is not anonymous.

Keep the Finder updated of progress throughout the process, except when this is not possible due to the Finder engaging anonymously.

Aim to resolve valid vulnerabilities within 90 days. However, there may be times where fast resolution or any resolution is not a possible option, for a variety of reasons.

Report a Vulnerability

How to Report a Vulnerability (Single Point of Contact) To ensure you can communicate with us directly and rapidly, Warmup has established a dedicated Single Point of Contact (SPOC). This channel is operated by our Communications Manager and internal triage team.

If you believe you have discovered a security vulnerability in a Warmup product or service, please contact us immediately via:

Web Form

Email: smartdevices@warmup.com; technicaloperations@warmup.com

NOTE: We would recommend the use of the Web Form as it contains fields for all the pertinent information we would require.

If you prefer, you may also report vulnerabilities to us indirectly, or anonymously, via your national Computer Security Incident Response Team (CSIRT)

CERT-Bund
www.bsi.bund.de
certbund@bsi.bund.de

Report a Vulnerability

Link to statements of compliance

Link to 7iE Statement of Compliance

Link to 6iE Statement of Compliance

Link to 6iE mini Statement of Compliance

Link to Element Statement of Compliance