Product Safety

Report a Security Vulnerability or Security Incident

Confidential, fast, and without any preliminary review on your part

If you have any information regarding a potential vulnerability, tampering, or cyberattack in a LAMBRECHT meteo product, please notify our Product Security Team. You do not need to determine on your own whether there is a legal obligation to report it.

We will, of course, treat your report confidentially and forward it exclusively within the company to the appropriate departments.

DIRECT REPORTING CHANNEL

Please email us directly. You can use this address without having to fill out a form or complete a CAPTCHA.

cyber-security-cra@aem.eco

You will receive an automatic acknowledgment of receipt. This does not constitute a commitment to a specific public processing or response timeframe.

INFORMATION

What Helps Us During the Exam

You can also report a tip that has not yet been fully investigated. Please provide only the information necessary for the investigation.

01 Product

Product name, model, product family, and serial number, if needed for identification.

Version 02

Firmware or software version and, if applicable, the configuration being used.

03 Observation

A brief description of the vulnerability, manipulation, or unusual behavior.

04 Time and Environment

Date, time, and operational environment in which the behavior was observed.

05 Supporting Documents

Traceable test steps, log data, or screen captures, if available.

06 Impact

The observed or potential impact and contact information for questions.

Attachments and Sensitive Information

Standard email attachments are permitted and will be technically reviewed. Particularly sensitive or very large documents should not be sent via email without prior coordination.

  • Do not send passwords, access codes, or private keys.
  • Remove or redact any unnecessary personal information.
  • If you're sending sensitive or large files, start by sending a short message without them.
  • We will then work with you to determine a suitable method of transmission.

Which products are covered?

This contact point applies to products for which LAMBRECHT meteo GmbH is listed as the manufacturer.

We also accept reports regarding products from other companies in the AEM Group—such as Davis Instruments or Earth Networks—document them, and forward them to the appropriate department within the AEM Group.

For products from other manufacturers outside the AEM Group, please contact the manufacturer listed on the product or in the product documentation directly.

Intake · Assessment · Coordination

How We Handle Your Report

We review verifiable reports and treat technical details and contact information as confidential, unless legal obligations require us to disclose them.

01 Entrance

Our security inbox accepts your message and attachments and automatically confirms receipt.

02 Rating

We will classify the product in question, review the technical information, and ask for clarification if necessary.

03 Coordination

We involve the relevant departments or suppliers and coordinate potential remedies and communication.

Responsible Disclosure

Guidelines for the Coordinated Disclosure of Vulnerabilities

Please do not disclose any technical details until we have had a chance to review the report and coordinate an appropriate resolution.

Scope of Application

This policy applies to products with digital components for which LAMBRECHT meteo GmbH is listed as the manufacturer. It also applies to components from suppliers that are included in these products.

Rules for Security Checks

This policy does not grant general permission to examine third-party systems or products without authorization. Security audits may only be conducted on products, systems, and data for which you have valid authorization.

  • Test only to the extent necessary to confirm and describe the potential vulnerability.
  • Avoid accessing personal or confidential data belonging to third parties.
  • Do not delete or damage any data, and do not interfere with operations.
  • Do not carry out denial-of-service, social engineering, phishing, or physical attacks.
  • Do not disclose any login credentials, private keys, or other confidential information.

How We Handle Your Report

We automatically confirm receipt and review verifiable reports. Depending on the circumstances, we may request additional information, consult with technical departments or suppliers, and coordinate appropriate corrective or risk mitigation measures.

Coordinated Release

The timing and scope of any disclosure will be determined on a case-by-case basis. In doing so, we will take into account the risk to users, the availability of a remedy, and statutory disclosure requirements. There is no entitlement to recognition, compensation, or a reward.

No bug bounty program

This policy is not a bug bounty program. Compensation may only be offered pursuant to a separate written agreement.

Legal Classification

Compliance with this policy does not replace any required consent and does not grant authority to take actions that would be unlawful without permission. This policy is not binding on government agencies, operators of third-party systems, or other third parties.

Note: If there is an immediate danger to people or property, please contact the appropriate emergency services. Do not use the Product Security email address for general technical support.

Other Concerns

For technical support questions, complaints, replacement parts, or general product inquiries, please use our technical support service or the general contact page.

data protection

We process the data submitted with your report to investigate, handle, and document the security incident, as well as to comply with legal obligations.