Report a Product Cybersecurity Vulnerability

Wabtec is committed to the security of its products and to helping protect the customers and industries that rely on them. Wabtec's Product Security Incident Response Team (PSIRT) coordinates the receipt, assessment, remediation, and disclosure of potential cybersecurity vulnerabilities affecting Wabtec products.

Wabtec welcomes vulnerability reports from security researchers, customers, industry groups, vendors, partners, government agencies, CERTs, and other parties. We value good-faith security research and responsible vulnerability reporting as important contributions to improving the security and resilience of our products.

This Product Vulnerability Reporting Policy explains how to report a potential product cybersecurity vulnerability to Wabtec, what you can expect after submitting a report, and the rules that apply when conducting security research involving Wabtec products.

Please see below a brief description of how to report a vulnerability. The email contact serves as the single point of contact for Cyber Resilience Act purposes.

Report a Vulnerability

If you believe you have identified a cybersecurity vulnerability or security defect affecting a Wabtec product, please report it to the Wabtec Product Security Incident Response Team at: PSIRT [at] Wabtec [dot] com.

We encourage you to encrypt sensitive vulnerability information using Wabtec's public PGP key available below.

To help us evaluate your report efficiently, please provide as much of the following information as reasonably available:

  • Follow-up contact information (e.g. email address), or indicate if you wish to remain anonymous;
  • Description of the potential vulnerability;
  • Impacted Wabtec product, model, software or firmware and applicable version;
  • Vulnerability type or Common Weakness Enumeration (CWE), if known;
  • Configuration or conditions required to reproduce the vulnerability;
  • Step-by-step instructions how to reproduce the vulnerability;
  • Potential security, safety, operational, or privacy impact;
  • Proof-of-concept code, logs, network traces, screenshots, or other supporting information, where appropriate;
  • Any known or suspected exploitation of the vulnerability;
  • Whether information concerning the vulnerability has already been publicly disclosed; and
  • Any potential remediation or mitigation you have identified. 

Please do not include personal information, confidential customer information, or other data that is not necessary for Wabtec to assess the vulnerability.

Wabtec's PGP Key