Kapsch TrafficCom only engages with researchers and hackers who aquired KTC products in a legal way. Any detection of illegal activities that may bring harm to KTC and its image may entail legal action against the researcher or hacker.
At Kapsch TrafficCom, we believe vulnerability disclosure is a collaborative effort. Both Kapsch TrafficCom and security researchers share the responsibility of protecting users. To support this, we follow a coordinated vulnerability disclosure process with severity-based remediation targets and a structured public disclosure timeline. While remediation timelines are determined by the severity and impact of the vulnerability, public disclosure is generally expected within 90 days of reporting, or exceptionally up to 120 days when additional time is required to protect customers.
Timeline Adjustments
If the deadline falls on a weekend or a public holiday, it’s extended to the next business day. If the relevant team confirms a patch will be released within 14 days after the deadline, we may delay disclosure until the patch is available.
For vulnerabilities under active exploitation (known as “0days”), we accelerate disclosure to 30 days. This shorter window allows our customers to take protective measures, even if a patch isn’t ready.
After 90 days (or 30 days for 0days), if no fix or advisory is available, we support researchers in making the details public (creating a CVE) to help users defend themselves.
Fairness & Flexibility
We reserve the right to adjust timelines in exceptional cases, but we apply our policy consistently across all products and solutions. Our goal is to improve industry response times and reduce the window of opportunity for attackers.
Expected Communications
After a vulnerability report is submitted, Kapsch TrafficCom will acknowledge receipt, assess the validity and impact of the report, and keep the reporter informed of significant milestones, including remediation progress, expected timelines, and final resolution.