PRODUCT SECURITY AND COORDINATED VULNERABILITY DISCLOSURE
DOVER EUROPE SARL (MARKEM-IMAJE)
Our commitment to product security
At Markem-Imaje cybersecurity is an integral part of how we design, develop, manufacture, deploy, and maintain our products. We are committed to protecting our customers, partners, and stakeholders by continuously improving the security and resilience of our products throughout their lifecycle.
We recognize the important role that customers, partners, security researchers and the broader security community play in identifying and responsibly reporting potential vulnerabilities. Our Coordinated Vulnerability Disclosure (CVD) process provides a clear and transparent mechanism for reporting security vulnerabilities and working collaboratively towards their timely resolution.
Our vulnerability management and disclosure practices are aligned with industry-recognized security principles and applicable regulatory requirements, including relevant obligations under the EU Cyber Resilience Act (CRA).
Overview
1. Vulnerability submission
A customer, security researcher, partner, supplier, or other stakeholder reports suspected security vulnerability through our designated reporting channels.
2. Acknowledgement
Our Product Security Incident Response Team (PSIRT) reviews the submission and acknowledges receipt of the report, typically within a reasonable timeframe.
3. Triage and validation
The reported issue is assessed to determine:
- Whether the issue represents a valid security vulnerability.
- Affected products, software versions, firmware versions, or services.
- Potential impact on confidentiality, integrity, availability, privacy, or safety.
- Severity, exploitability, and customer impact.
4. Investigation and risk assessment
The Product security incident response team (PSIRT) coordinates with product engineering, software development, quality, compliance, and other stakeholders to investigate the issue, determine root cause, and assess risk.
5. Remediation and verification
Appropriate remediation actions may include:
- Software patches.
- Firmware updates.
- Security configuration changes.
- Mitigation guidance.
- Product documentation updates.
6. Customer communication
Where appropriate, customers are informed through security advisories, release notes, direct communications, or other approved communication channels.
7. Coordinated public disclosure
We support responsible and coordinated disclosure practices. Public disclosure should occur only after remediation or mitigation is available, or after an agreed disclosure timeline has been reached.
8. Continuous improvement
Lessons and improvements from vulnerability investigations are incorporated into our secure development lifecycle, threat modeling activities, security testing programs, and product security governance processes.
Scope
In Scope include:
- Hardware products designed, developed, or manufactured by Markem-Imaje.
- Software applications and platforms developed by Markem-Imaje.
- Embedded software and firmware components.
- Product security vulnerabilities that may impact customers, partners, or business operations.
Vulnerability assessment considerations
Reported vulnerabilities may be evaluated based on:
- Product and version affected.
- Ease of exploitation.
- Potential business impact.
- Potential customer impact.
- Safety implications.
- Privacy implications.
- Availability of mitigations.
- Regulatory and contractual obligations.
Reporting a security vulnerability
We encourage responsible disclosure of suspected vulnerabilities affecting our products and services.
Contact information
Product Security Incident Response Team (PSIRT)
Information to include
To assist with our investigation, please include:
- Product name.
- Product version and configuration.
- Detailed vulnerability description.
- Reproduction steps.
- Screenshots, logs, packet captures, or proof-of-concept code (if available).
- Potential impact assessment.
- Contact information for follow-up discussions.
What Happens After Submission?
Upon receiving your report:
- We acknowledge receipt of the submission.
- We assign a tracking reference.
- Our PSIRT performs initial triage and validation.
- Additional information may be requested if necessary.
- Risk and impact assessments are conducted.
- Remediation activities are coordinated with relevant teams.
- Security advisories and customer communications are prepared as required.
- Coordinated disclosure activities are managed with the reporter where applicable.
Expectations for Security Researchers
We welcome responsible security research and ask researchers to:
- Act in good faith.
- Avoid actions that may disrupt products, services, or customer operations.
- Avoid accessing, modifying, deleting, or disclosing customer data.
- Avoid privacy violations.
- Refrain from publicly disclosing vulnerabilities before remediation or an agreed disclosure timeline.
- Provide sufficient technical details to support validation and remediation.
Researchers who act responsibly and in good faith in accordance with this policy will be treated as valued contributors to our security program.
About our PSIRT
The Product Security Incident Response Team (PSIRT) is responsible for managing product security vulnerabilities throughout their lifecycle and coordinating vulnerability response activities across the organization.
PSIRT responsibilities
The PSIRT is responsible for:
- Receiving and tracking vulnerability reports.
- Validating and prioritizing vulnerabilities.
- Coordinating investigations and remediation activities.
- Managing vulnerability communications and disclosures.
- Publishing security advisories.
- Supporting regulatory reporting obligations.
- Driving continuous improvement in product security practices.
Governance
The PSIRT operates under the organization's Product Security Governance Framework and works closely with:
- Product Engineering.
- Software Development.
- Product Safety and Compliance.
- Customer Support.
- Executive Leadership.
Vulnerabilities are prioritized using a risk-based approach considering exploitability, customer impact, safety implications, business impact, and applicable regulatory requirements.
Security advisory program
To promote transparency and customer awareness, Markem-Imaje publishes security advisories for confirmed vulnerabilities affecting our products and services.
Advisory information
Security advisories may include:
- Vulnerability identifier (e.g., CVE).
- Affected products and versions.
- Vulnerability description.
- Severity assessment.
- Potential impact.
- Available patches or mitigations.
- Customer recommendations.
- Disclosure and publication dates.
Security advisory
Published advisories, mitigation guidance, and remediation notices are available at this Security Advisory section.
Customers are encouraged to review advisories regularly and implement recommended updates.
Note – we do not have any notifications as on date, and this section shall be populated as we encounter such in the future.
As part of our product security program, reported vulnerabilities may be assessed against applicable regulatory, legal, contractual, and industry obligations.
Where required, Markem-Imaje may notify relevant authorities, affected customers, distributors, partners, and other stakeholders regarding significant cybersecurity vulnerabilities or incidents in accordance with applicable laws and regulations, including the EU Cyber Resilience Act.
Our objective is to ensure vulnerabilities are addressed in a timely, risk-based, and transparent manner while protecting customers and maintaining product resilience.
This Coordinated Vulnerability Disclosure Policy is intended solely for reporting legitimate security vulnerabilities affecting products and services owned, developed, maintained, and supported by Markem-Imaje.
By submitting a vulnerability report, you acknowledge that:
- You have acted in good faith and in accordance with applicable laws and regulations.
- You have not intentionally accessed, modified, destroyed, or disclosed data beyond what is necessary to demonstrate the vulnerability.
- You have not conducted testing that negatively impacts confidentiality, integrity, availability, safety, or performance of products, services, or customer environments.
- Submission of a vulnerability report does not create any entitlement to compensation, reward, public recognition, or contractual relationship unless explicitly agreed by Markem-Imaje.
- Markem-Imaje reserves the right to determine vulnerability severity, remediation priorities, disclosure timelines, and communication methods.
- Activities involving unlawful access, privacy violations, operational disruption, or malicious intent may be referred to appropriate authorities.
- This policy does not authorize penetration testing, denial-of-service testing, social engineering, physical attacks, or any activity prohibited by law without prior written authorization.
Any personal data submitted as part of a vulnerability report will be processed solely for the purposes of evaluating, investigating, remediating, and managing the reported vulnerability, as well as complying with applicable legal and regulatory obligations. Reporters should avoid including unnecessary personal data, confidential customer information, credentials, or production data unless strictly necessary to demonstrate the reported vulnerability. Any personal data received through this process will be processed in accordance with the Markem-Imaje Privacy Notice and retained only for as long as necessary for these purposes. While Markem-Imaje will review vulnerability reports submitted in good faith, it does not guarantee that every submission will result in remediation, acknowledgement, or further communication. Where applicable, personal data may be shared with other Markem-Imaje entities, Dover group companies, or service providers strictly involved in the investigation and remediation of the reported vulnerability, subject to appropriate confidentiality, security, and data protection safeguards.
Quick Access Tools
