Product Vulnerability Reporting Policy

Scope

This Product Vulnerability Reporting Policy (“Policy”) applies to potential cybersecurity vulnerabilities affecting Wabtec products and its components, including associated software, firmware, and Wabtec-provided product-related digital services.

Wabtec welcomes reports concerning products regardless of whether the reporter has a commercial relationship with Wabtec. Reports concerning products that are no longer supported may be evaluated on a case-by-case basis. Acceptance or evaluation of such a report does not mean that Wabtec will provide a patch, update, or other remediation for a product outside its applicable support period.

This Policy is intended for product cybersecurity vulnerabilities. General product support, product quality issues without a cybersecurity impact, warranty claims, and other non-security matters should be directed to the applicable Wabtec customer support channel.

Testing of systems, networks, products, or environments owned or operated by Wabtec customers or other third parties is not authorized by this Policy.

Good-Faith Security Research

Wabtec supports good-faith security research intended to identify and responsibly report potential cybersecurity vulnerabilities in Wabtec products.

If you conduct security research in compliance with this Policy, act in good faith to avoid harm to Wabtec, our customers and other third parties, and promptly report identified vulnerabilities to Wabtec, Wabtec will not initiate legal action against you solely for that research.

This commitment applies only to claims that Wabtec has the legal authority to waive or control. It does not authorize access to or testing of systems, products, networks, or environments owned or operated by customers or other third parties without their permission, and it does not bind independent third parties or governmental or law-enforcement authorities.

You remain responsible for complying with applicable laws and obtaining any authorization required from the owner or operator of a system, product, network, or environment.

If you are uncertain whether particular research is consistent with this Policy, please contact Wabtec PSIRT before proceeding.

Rules of Engagement

To promote responsible research and protect Wabtec customers, employees, operations, and other third parties, researchers participating under this Policy must:

• Make a good-faith effort to avoid harm to Wabtec, our customers, other third parties, and the public;
• Conduct testing only on products, systems, and environments that you own or for which you have appropriate authorization;
• Avoid testing third-party services or infrastructure, including customer production environments unless you have separate authorization from the applicable third party;
• Avoid any activity that could adversely affect the safety or availability of railway, transit, mining, industrial, or other operational environments;
• Avoid interfering with rolling stock, train control, signaling, braking, communications, or other operational or safety-related functionality;
• Avoid denial-of-service, resource-exhaustion, destructive, or disruptive testing;
• Avoid physical security testing and social engineering, including phishing;
• Avoid introducing malware, ransomware, persistence mechanisms, or other malicious functionality;
• Avoid accessing, modifying, deleting, downloading, or exfiltrating data beyond the minimum necessary to demonstrate the existence and potential impact of a vulnerability;
• Stop testing and directly notify Wabtec if you obtain access to sensitive data, credentials, customer information, or functionality beyond what is necessary to demonstrate the vulnerability;
• Avoid lateral movement or attempts to establish continued access after a vulnerability has been demonstrated;
• Avoid uploading non-public vulnerability information, customer information, or other sensitive information to public or third-party services where doing so could result in unauthorized disclosure; and
• Coordinate disclosure of the reported vulnerability with Wabtec as described below, in particular, do not publicly disclose identified vulnerabilities until Wabtec has confirmed remediation of the identified vulnerability.

Research involving safety-related functionality should be performed only in an appropriately controlled, non-operational environment and with all required authorizations.

Generally Out of Scope

Wabtec generally does not treat observations concerning security best practices or configuration issues without a demonstrable cybersecurity impact as product cybersecurity vulnerabilities.

Examples may include:

• Informational version disclosure without demonstrated security impact;
• Missing or recommended HTTP security headers without demonstrated exploitability;
• Theoretical vulnerabilities without a credible attack path or security impact;
• Findings that depend solely on obsolete or unsupported third-party browsers, operating systems, or platforms;
• Issues requiring implausible user interaction without meaningful security impact; and
• Other configuration or security-hardening recommendations that do not create a material confidentiality, integrity, availability, privacy, safety, or operational risk.

This list is illustrative rather than exhaustive. Wabtec may evaluate any report where the reporter demonstrates a meaningful cybersecurity, safety, privacy, or operational impact.

If you are uncertain whether an issue is in scope, we encourage you to report it.

What Happens After Your Report a Vulnerability

Wabtec PSIRT coordinates the handling of reported potential product cybersecurity vulnerabilities. The process generally consists of the following stages.

1. Receipt and Triage

Wabtec PSIRT receives and performs an initial review of vulnerability reports.

Wabtec PSIRT accepts reports at any time and will endeavor to acknowledge receipt of a vulnerability report within two business days.

Reports indicating an imminent safety risk, active exploitation, or significant customer or operational impact will be prioritized for expedited assessment.

2. Technical Assessment

Wabtec evaluates potential reported vulnerabilities and, as appropriate, works with relevant product, engineering, cybersecurity, safety, legal, and other teams to:

• Validate and reproduce the reported issue;
• Determine affected products and versions;
• Assess potential cybersecurity, safety, privacy, and operational impact;
• Evaluate exploitability and severity; and
• Determine whether additional information is required from the reporter.

Wabtec may contact the reporter during this process for additional technical information or clarification.

3. Remediation and Mitigation

For validated vulnerabilities, Wabtec will determine appropriate remediation or risk-mitigation measures based on the circumstances.

Depending on the vulnerability and affected product, these measures may include software or firmware updates, configuration changes, compensating controls, workarounds, customer guidance, or other measures.

Response and remediation timelines vary depending on factors including the vulnerability's severity and complexity, affected products, safety considerations, availability of mitigations, product lifecycle status, and the need to coordinate with customers, suppliers, technology providers, regulators, CERTs, CSIRTs or other affected parties.

4. Coordinated Disclosure

Wabtec seeks to coordinate disclosure of product cybersecurity vulnerabilities in a manner that helps protect customers and other affected parties. 

We ask reporters to maintain the confidentiality of non-public vulnerability information while Wabtec investigates the issue and, where appropriate, develops and coordinates remediation or mitigation measures. 

Wabtec will seek to work in good faith with the reporter to establish an appropriate disclosure timeline, where appropriate. Disclosure timing may take into account factors including:

• Vulnerability severity and exploitability;
• Evidence of active or imminent exploitation;
• Potential safety or operational consequences;
• Availability and validation of remediation or mitigation measures;
• Deployment considerations for affected customers;
• Coordination with suppliers and other affected parties; and
• Applicable legal and regulatory requirements

Researchers should not publicly disclose vulnerability details before an agreed coordinated disclosure date unless otherwise required by applicable law.

5. Recognition of Reporter

Where appropriate and with the reporter's consent, Wabtec may acknowledge the reporter in a published security advisory or other vulnerability communication. Reporters may also request that their identity remain confidential or that they not receive public recognition.

Security Advisories and Customer Notifications

Where appropriate, Wabtec may publish a security advisory or provide other notifications to help affected customers understand and address an identified cybersecurity risk. 

Depending on the circumstances, an advisory or notification may include:•    A description of the vulnerability;

• Affected products and versions;
• A CVE identifier and vulnerability severity information, where applicable;
• Potential cybersecurity, operational, or safety impact;
• Known mitigating factors or workarounds; and
• Available patches, updates, configuration changes, or other recommended actions.

The timing, form, and content of a notification will depend on the circumstances of the vulnerability, including customer safety and security, exploitation risk, remediation availability, affected products and customers, coordination with third parties, and applicable legal and regulatory requirements.

Where appropriate, Wabtec may coordinate vulnerability information with relevant CERTs, CSIRTs, other government authorities, industry organizations, suppliers, or other affected stakeholders.

No Bounty or Compensation

Unless Wabtec expressly agrees otherwise in writing, this Policy does not constitute a bug bounty program, and submission of a vulnerability report does not create an entitlement to compensation, reimbursement, or other payment.

Policy Limitations

Participation in this vulnerability disclosure program does not grant any right or license in Wabtec intellectual property except to the limited extent necessary to conduct research permitted by this Policy.

Nothing in this Policy authorizes activity that violates applicable law or the rights of a third party.

Wabtec may update this Policy from time to time to reflect changes in its products, vulnerability management processes, applicable requirements, or security best practices.

Contact Wabtec PSIRT

Potential product cybersecurity vulnerabilities should be reported to the Wabtec Product Security Incident Response Team: PSIRT [at] Wabtec [dot] com 

For sensitive vulnerability information, please use Wabtec's public PGP key.