Skip to main content
Danfoss

Coordinated vulnerability disclosure

Our security commitment

Danfoss takes security seriously and is committed to handling vulnerabilities and security incidents responsibly in accordance with industry best practices and applicable cybersecurity regulation, including EU Cyber Resilience Act - CRA.

If you identify a security vulnerability or incident related to a Danfoss product or service, please report it to us.

Report a vulnerability

Overview

Vulnerability disclosure policy
Vulnerability disclosure policy

Before reporting a vulnerability, please read the policy including the scope and the process.

Security advisories
Security advisories

Check for already identified vulnerabilities

Hall of thanks
Hall of thanks

Discover the recognition given to those who responsibly report security issues.

Guidelines for how to report a vulnerability

  • Familiarize yourself with the Danfoss Coordinated Vulnerability Disclosure Policy.
  • Use this form to report any potential vulnerabilities.
  • We strive to respond promptly. Please engage in a constructive dialogue with us.
  • Only demonstrate the existence of a vulnerability to the extent necessary. Avoid altering configurations or disrupting the normal operation of a production system, unless explicitly authorized.
  • Obtain consent from Danfoss before sharing information about identified vulnerabilities with any third party.
  • Once the data for reporting a security issue is no longer needed, securely erase it to ensure it cannot be recovered.

Our response to security concerns

  • We will strive to respond as quickly as possible. Our standard response time to acknowledge receipt of vulnerability reports is two business days.
  • We will keep you informed throughout the vulnerability disclosure process, providing quick and periodic updates until the potential issue is resolved.
  • We will contact you once the reported vulnerability is remediated.
  • We maintain a Hall of thanks to recognize and credit individuals, organizations, or companies who ethically report security issues in Danfoss' products and services.
  • Please note that we do not offer monetary rewards or a threat hunting program.