Cybersecurity at the TII Group

Policy and Process

Report

The Product Security Incident Response Team (PSIRT) is the central point of contact for reporting security vulnerabilities in TII Group products.
No non-disclosure agreement, support contract, or other agreement is required to submit a report. We prefer to receive reports in German and English.

Report format:

• Your contact information: Name, pseudonym, or organization
• Your contact details (for follow-up and coordination): Email address, phone number
• Affected products: Product name, model, type, variant, version
• Identifier: Vehicle Identification Number (VIN), serial number
• Description of the vulnerability
• Environment and technical requirements
• Steps to reproduce (proof-of-concept)
• Possible impacts and consequences
• Indications of active exploitation or serious security incidents
• Attachments: screenshots, log files, screenshots

Before submitting a report, please check whether any security advisories or updates have already been published for the affected product.  In this case, a new report is not necessary.
Reports may be submitted anonymously. Please note that in the case of an anonymous report, technical and content-related inquiries will not be answered, and such reports may therefore be processed only to a limited extent or not at all.

Analysis and measures

Every report is recorded, analyzed, and evaluated.
Under the Cyber Resilience Act (Regulation (EU) 2024/2847), we are legally required to report actively exploited vulnerabilities and serious security incidents to the European Union Agency for Cybersecurity (ENISA) and the German Federal Office for Information Security (BSI) within defined reporting deadlines.
If a vulnerability is confirmed, we assess its impact and risk. Based on this assessment, we develop appropriate remedial or corrective measures as needed to mitigate the risk or resolve the issue (e.g., updates). In doing so, we take into account the interests of affected users as well as regulatory and security-related requirements.
The time required to resolve the issue depends on the cause, complexity, and product lifecycle.

Disclosure

We publish confirmed and resolved vulnerabilities as security advisories on this website.
We consider a report closed if

• the information provided proves to be unfounded,
• the vulnerability has been fixed and disclosed,
• you do not respond to our inquiries for at least 30 days, or
• the vulnerability is already publicly known.

We will notify you immediately of the closure, provided your report was not submitted anonymously.

Security Advisory

A security advisory lists the affected products (name, model, type, variant, version), a description of the vulnerability, the impact and risks, and recommended actions (e.g., updates). Please check regularly to see if there are any new advisories for your products.
Security advisories are published in this section as soon as they become available.

Safe Harbour

We do not intend to take legal action against anyone as long as there are no apparent criminal intentions.

Confidentiality

We will treat your report and your contact information as confidential. We will keep details about the vulnerability confidential until coordinated disclosure. We will not share your personal information with third parties without your consent.