Report a security vulnerability

Please enter your name.

Example: Jane Doe

Helps us confirm the exact unit configuration, if needed. you can find this on the type plate on your controller.

Example: 45445

What the issue is, and what it could allow someone to do.

Example: "The web interface accepts settings changes without checking who's logged in, so anyone on the network can change them."

Please describe step by step so we can see the same behavior on our side.

Example: "1. Connect to the unit's IP on port 80. 2. Send a POST request to /api/settings without a login token. 3. Settings change without authentication."

Please enter the date and time when you noticed the vulnerability for the first time

Example: 14 March 2026, 10:30, CET

Tells us whether this is isolated or wider-reaching.

Example: If you found this on one machine at one factory, choose "One."

This helps us work out whether the issue needs to be reported to the authorities under the rules we follow. Every report is looked at by Movacolor regardless of your answer here — this question just helps us handle it correctly from the start.

Example: Logs showing repeated unauthorized access attempts that succeeded.

Screenshots, logs, or packet captures help us verify and reproduce the issue faster.

Example: A screenshot of the settings changing without a login prompt.

This helps us route your report correctly and, if needed, meet our reporting obligations to the authorities on time. Every report is reviewed by Movacolor either way — this just tells us which process to start with.

Example: If your production line stopped unexpectedly because of this issue, that's an incident. If you found a flaw during testing that hasn't caused real-world effects, that's a vulnerability.

A quick screening question — could an operator be locked out of the product or a key function?

Example: The touchscreen freezes and can't be used until the unit is rebooted.

Tells us whether the product could be made to do something it wasn't designed to do.

Example: Someone sends a command that makes the unit run a script it shouldn't.

We mean whichever network or systems this product is connected to. If you operate the equipment yourself, that's your own network. If you're reporting this on behalf of someone else — for example, as a distributor, integrator, or reseller — it means their network.

Example: The vulnerability lets someone move from the unit onto the wider factory network it's connected to.

How serious this is depends on two things: how sensitive the information is, and how many people could have seen it.

Example: A device's serial number becoming visible to another customer = Low. Material information becoming publicly downloadable = High.

How badly could product or process quality be affected?

Example: A setting needing to be re-entered after a reset = Low. A wrong dosing ratio that wastes material and produces an out-of-spec batch = High.

How long, and how often, could the product be unusable?

Example: A quick reboot fixes it in a few minutes = Low. The unit is down for two hours and needs a remote support = High.

The worst thing that could realistically happen to a person's safety, or to the equipment.

Example: A small injury from touching moving parts, such as dosing screws with no effect on how the equipment works = Low. An unexpected motor start during maintenance that could cause a serious injury = High.

This tells us how someone would need to get to the affected part of the product — for example, whether they'd need to be physically standing at the machine, or could reach it over the internet.

Example: Needing someone to be physically present at the machine = Physical. Reachable from the wider factory network where IT and OT systems connect = Adjacent.

This is about how often someone would realistically get the chance — separate from how hard it would actually be to do.

Example: Only reachable during occasional, tightly controlled maintenance visits = Restricted. Reachable by multiple people as part of normal daily operations = Broadly Available.

The less skill it takes, the more people could potentially do this.

Example: Needing deep, specialist knowledge of this exact equipment = Expert. Just needing a web browser and basic tools = Basic.