CONTACT FORM

Report a vulnerability or security issue

Contact Form:

 

For more information, please see our privacy policy.

 

Please use this page to report potential security vulnerabilities in products and software. See the following guidelines for more information on vulnerability disclosure.

Vulnerability Disclosure Policy​
THORN is a provider of integrated lighting solutions for professional indoor and outdoor lighting and offers a comprehensive range of high-quality luminaires, lighting control systems and multi-purpose sensors for various applications in professional lighting. As a manufacturer of technologically sophisticated control systems and software, safety is also a core value of THORN. Therefore, THORN is committed to ensuring the safety of users of THORN products and software by protecting their privacy and data.

Because THORN values the contribution of outside security researchers acting in good faith to help THORN maintain a high standard of privacy protection for our users and systems, this policy is intended to provide security researchers with clear guidelines for conducting vulnerability disclosure activities and to communicate our preferences in reporting discovered vulnerabilities to us. ​

We strongly encourage you to contact us to report potential security vulnerabilities in products and software.

Authorization​
If you make a good faith effort to comply with this policy during your security research, THORN will treat this responsibly, and work with the reporter of the vulnerability to understand the issue to eventually resolve the issue.

Guidelines​
Under this policy, “research” means activities in which you:​

  • Notify us as soon as possible after you discover any real or potential security issue.​
  • Make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or manipulation of data.​
  • Only use exploits to the extent necessary to confirm a vulnerability’s presence. Do not use an exploit to compromise or exfiltrate data, establish persistent command line access, or use the exploit to pivot to other systems.​

Once you’ve established that a vulnerability exists or encounter any sensitive data (including​ personally identifiable information, financial information, or proprietary information or trade​ secrets of any party), you must stop your test, notify us immediately, and not disclose this​ data to anyone else.

Scope​
This policy applies to the following systems and services:​ THORN branded products, associated firmware and product related software.

Reporting a vulnerability​
Information submitted under this policy will be used for defensive purposes only – to mitigate or remediate vulnerabilities. If your findings include vulnerabilities that affect all users of a product or service and not solely THORN, we may share your report with anonymous information with concerned parties such as suppliers, cooperation partners, distributors, customers without express permission.​

We recommend using the form below, but we also accept vulnerability reports via email to security@zumtobelgroup.com.​

Reports may be submitted anonymously.

Reporting Rules​
In order to help us triage and prioritize submissions, we recommend that your report:​

  • Is in English, if possible​
  • Contain a description of the issue​
  • Names the article number of the product in question​
  • Names manufacturing date (if applicable)​
  • Names software version (if applicable)​
  • Contains a description of the location the vulnerability or security issues was discovered and the potential impact of the exploitation​
  • Contains detailed description of the steps needed to reproduce the vulnerability (proof of concept scripts or screenshots are helpful)

What you can expect from us / response times​
When you choose to share your contact information with us, we commit to coordinating with you as openly and as quickly as possible.​

Within 5 business days excluding Saturdays, we will acknowledge that your report has been received.​

After having been informed of a compliance failure, we will provide you every 20 calendar days with a status update until the resolution of the reported security issues