Informatik Werkstatt

Security & Vulnerability Disclosure

Coordinated Vulnerability Disclosure Policy · as of November 2026

Informatik Werkstatt GmbH develops UpCom, a data acquisition application for Option CloudGate gateways, and ViewMondo, which we operate as a cloud service and which is also installed on customer servers. We also operate the remote access service UpComRemoteAccess. UpCom and ViewMondo are distributed exclusively by OTT HydroMet (including its Kipp & Zonen brand). We take the security of our products seriously and welcome reports from security researchers, customers and partners.

How to report

Email: security@informatik-werkstatt.de
Encryption (optional): OpenPGP key pgp-key.txt, fingerprint
64F3 02D0 C4C5 B8ED 3493 C0C3 B881 8D07 CE78 D9F8

Please include:

  • product and version, for UpCom also the CloudGate hardware generation (both shown on the UpCom status page),
  • a description of the issue,
  • steps to reproduce or a proof of concept,
  • your assessment of the impact.

Reports in English or German are welcome. Customers may also report through their OTT HydroMet support contact, which forwards security reports to us.

Scope

  • UpCom (all versions within their support period), including its web UI pages, its network services (OPC UA server, Modbus TCP server, TLS/TC57 server, NTCIP SNMP subagent, transparent mode, NDOT gate controller), its outbound clients and the bundled Python scripts.
  • ViewMondo (all versions within their support period): the web application, the Windows service and its network services (station collectors, device API used by UpCom, app API), both on-premise installations and the cloud service viewmondo.com.
  • UpComRemoteAccess (upcom.viewmondo.com).

This covers UpCom on both CloudGate hardware generations; the support period and CE conformity apply to the current generation (i.MX93) only.

Out of scope:

  • the CloudGate base firmware, its web server and the libraries of the CloudGate SDK (OpenSSL, curl, Python, net-snmp etc.) – these are maintained by Option; please report them to Option. We forward reports that reach us;
  • the operating environment of on-premise ViewMondo installations (Windows, IIS, .NET Framework, database server, CodeMeter runtime) – please report these to their vendors;
  • denial-of-service tests against production systems, automated scanning of our cloud systems, access to other customers’ data, social engineering and physical attacks.

If you are unsure whether a finding is in scope, report it anyway – we will forward it to the responsible party.

What you can expect

  • Acknowledgement of receipt: within 2 working days
  • Initial assessment (valid / not valid, preliminary severity): within 10 working days
  • Status updates: at least every 30 days until resolved
  • Fix for critical / high severity: aim within 30 / 90 days
  • Public advisory: when a fixed version is available, coordinated with you

We assess severity with CVSS v3.1 / v4.0. We do not take legal action against researchers who act in good faith under this policy: who only access data needed to demonstrate the issue, do not degrade service for others, do not keep or share personal data, and give us reasonable time to fix the issue before publishing (default embargo: 90 days, negotiable).

We credit reporters in the advisory unless they prefer to stay anonymous. We do not currently run a paid bug bounty program.

Actively exploited vulnerabilities and severe incidents are additionally reported by us to the competent CSIRT and to ENISA as required by Article 14 of Regulation (EU) 2024/2847 (Cyber Resilience Act).

Security advisories

Advisories are published on this page and, where a CVE is assigned, in the CVE / EU vulnerability database. Customers are notified through OTT HydroMet.

No advisories have been published yet.

Machine-readable contact

/.well-known/security.txt (RFC 9116)

← To the home page