1. Strategy for the Coordinated Disclosure of Vulnerabilities

Publisher: romutec Steuer- u. Regelsysteme GmbH

Version 1.0, dated 08 September 2026

Next review: no later than 07 September 2027

Lega reference: Annex I Part II, points 5 and 6 of Regulation (EU) 2024/2847

Why does this page exist?

romutec develops and manufactures components for technical building automation. Our products are designed for use in systems that remain in operation for many years and in which security issues cannot simply be left unresolved. 

Despite careful development and testing, not all vulnerabilities can be identified in advance. If you notice anything unusual in one of our products, we want to know about it - before others do.

How to Contact Us

Email: psirt@romutec.de

For confidential reports, a PGP key is available at: https://www.romutec.de/.well-known/pgp-key.asc

We also use this key to sign our security.txt file. 

Fingerprint: 65FB E17A 1DE6 2D75 E166 AC7A 87D2 892B 343E DC4D

The detached signature is available at: https://www.romutec.de/.well-known/secuirty.txt.sig

For follow-up questions, an email address or telephone number is sufficient. In this case, however, we will be unable to ask follow-up questions or inform you of the outcome. In addition, we will not be able to meet the response times stated above because there is no recipient to whom we can send a response.

A confidentiality agreement is not required. We do not offer rewards for reports - we do not operate a bug bounty program. Upon request, we will acknowledge you by name in the publication. 

Language of Communication

We accept reports in German and English. Both are handled by the same team and according to the same procedure.

Binding statements regarding the assessment of vulnerability, the timeline, and publication are made in German. Upon request, we will explain them in English. In the event of any discrepancy in interpretation, the German version shall prevail.

What Information Helps Us

The more precise the report, the faster we can assess it. The following information is helpful:

About the affected product

• Article number and type designation (e.g. 00003192 / TCP-RTU-GW-1/2)
• Firmware or software version, if available
• Operating environment: connection, protocol, higher-level system 

About the vulnerability

• Description of the issue and its potential impact
• Steps to reproduce the issue, including expected versus actual behavior
• Prerequisites such as network access, bus access, or physical access
• Evidence such as protocol captures, screenshots, or logs

About the urgency

• To your knowledge, is the vulnerability already being actively exploited?
• Is it already publicly known, for example through a third-party publication or a Common Vulnerabilities and Exposures (CVE) entry?

Please only provide personal data that is necessary for processing the report. When submitting a report by email, your sender address is transmitted for technical reasons.

What You Can Expect from Us

What We Ask of You

We consider your investigation to be authorized security research if you:

• Inform us as early as possible once you discover a potential vulnerability,
• Only test to the extent necessary to confirm the issue,
• Do not alter, delete, copy, or disclose any data, 
• Do not impair any systems, services, or their users - building automation controls ventilation, fire dampers, and safety-related functions; an unsuccessful test can have real-world consequences,
• Only test devices that you are authorized to access, and not third-party installations,
• Allow us reasonable time to analyze and remediate the issue before making it public,
• Refrain from automated mass reporting without meaningful technical substance. 

Legal Protection

romutec will not take legal action against individuals who report a potential vulnerability in good faith and in accordance with the principles outlined above. 

Scope

This strategy applies to:

• All products placed on the market by romutec under its own name or brand, including firmware and embedded software,
• The ROBAConnect configuration and commissioning software, 
• Digital interfaces and communication connections of these products,
• Web services operated by romutec.

Systems and services provided by third parties that are neither developed nor operated by romutec are not covered. This also includes third-party software that we merely make available for download - in such cases, please contact the respective manufacturer. Upon request, we will forward reports to the appropriate party.

For products developed or manufactured by romutec for partners and marketed under the partner's brand, the respective partner is the responsible manufacturer. You are still welcome to report such cases to us - we will establish contact with the responsible party. 

If you are unsure whether your finding falls within the scope of this strategy, please report it to us. We will clarify the appropriate responsibility. 

Publication

If a vulnerability is confirmed, we will publish a security advisory as soon as a solution, update, or effective protective measure is available. The advisory will include a description of the vulnerability, information on how to determine whether a product is affected, an assessment of its severity, and clear instructions on the recommended actions. 

In justified cases, we may delay publication if the risks of early disclosure outweigh the security benefits - at most until users have had the opportunity to apply the patch. 

We ask that you coordinate publication with us. Our products may also be installed in systems with increased security requirements where an update cannot be applied at short notice. 

When a Procedure Is Considered Closed

We consider the handling of a report to be completed in the following cases:

• Our assessment has determined that the reported issue is unfounded.
• The vulnerability has been remediated or mitigated by an update or an effective protective measure and has been published.
• The vulnerability affects a web service operated by romutec, has been remediated and has been published.
• No response to technical or substantive follow-up questions has been received for at least 30 days and the report therefore can not be processed any further.

We will inform you when the procedure has been closed, provided that we have a means of contacting you.

Legal Reporting Obligations

As a manufacturer, we are required under Article 14 of the CRA to report actively exploited vulnerabilities and severe security incidents simultaneously to the CSIRT designated as coordinator and to ENISA. Your report may trigger such a regulatory reporting obligation. Information about your identity is not part of the mandatory reporting content; we will not disclose it unless we are legally required to do so. 

2. Security Environment A - Fieldbus Modules

Legal basis: Annex II, point 4 (intended purpose including the security environment) and point 5 (reasonably foreseeable misuse) of the CRA.

Applies to: romod and romod eco, robutec RBT, RDC600 / RDC700 / RDC800, FBM, FBB, FBX, BUS-tecMod, MR-BUStec.

Intended Purpose

These products are input/output modules and operating modules for technical building automation. They are not capable of standalone operation. They operate as participants on a fieldbus and are controlled and queried by a higher-level system - a DDC, PLC, or building management system. The local priority operating level additionally allows manual override on site. 

The products are intended for installation in control cabinets, control cabinet doors, and technical rooms and are intended exclusively for commercial use by qualified personnel. 

Required Security Environment

The fieldbus protocols used - Modbus RTU and BACnet MS/TP over RS485, as well as device-internal buses - do not provide authentication or encryption. This is a characteristic of these protocol standards, not a limitation of our products. In practical terms, this means: Anyone with physical access to the bus segment can read from and control all devices connected to it.

Secure operation therefore requires:

1. Physical access protection. Installation in locked control cabinets or technical rooms. Access only for authorized personnel.
2. Isolated bus segment. The RS485 segment must remain entirely within a physically controlled area. It must not extend into publicly accessible areas or be routed along freely accessible cable paths.
3. Access control at the higher system level. User authentication and authorization of interventions are provided by the higher-level DDC or building management system. Our devices do not provide these functions and are not intended to do so. 
4. Network separation when connected to IP networks. If the bus segment is connected to an IP network via a gateway, this network must be placed in a dedicated segment separated from the office IT network and without direct accessibility from the Internet. Security Environment B additionally applies to the gateway. 
5. Trusted bus participants. All devices operated within the same segment are considered equally trusted. Third-party devices of unknown or unverified origin must not be connected to the same segment.

Reasonably Foreseeable Misuse

The following configurations result in significant cybersecurity risks and are not covered by the intended use:

• Extending the RS485 segment into unprotected or publicly accessible areas.
• Connecting the bus segment to the general corporate network or to the Internet, regardless of the gateway used. 
• Remote access to the bus segment without a preceding VPN connection and without network segmentation.
• Operating devices on the same bus segment together with devices whose trustworthiness cannot be assessed. 
• Using the modules for safety-related functions without the independently required safeguards. The integrated functions for controlling and monitoring fire dampers support system operation; they do not replace an independent safety system. 

Residual Risk

Even when the described security environment is maintained, there remains a risk that a person with physical access to the bus segment may manipulate data points. This risk is inherent to the protocol and cannot be eliminated at the device level. It is mitigated by the organizational and physical security measures described above. 

3. Security Environment B - Network Devices

Legal basis: As for Security Environment A. 

Applies to: RSW5.24 (Ethernet switch) and TCP-RTU-GW-1/2 (Modbus gateway) 

Intended Purpose

RSW5.24 is an unmanaged 5-port Ethernet switch for DIN rail mounting. It distributes Ethernet connections within a control cabinet. 

TCP-RTU-GW-1/2 converts Modbus TCP to Modbus RTU. On the TCP side, the device operates as a server and can be accessed via Ethernet or WLAN; on the serial side, it acts as the master of two RS485 segments. Configuration and diagnostics are performed via a web interface.

Both devices are intended for installation in control cabinets and exclusively for commercial use by qualified personnel. 

Required Security Environment

1. Dedicated automation network. Operate exclusively within a dedicated, segmented network for building automation. Not within the general corporate network, not within guest networks, and under no circumstances directly connected to the Internet.
   
2. No external accessibility. No port forwarding and no public IP address. Remote access exclusively via VPN.
3. Change access credentials. All factory-set gateway credentials - the WLAN password of the access point and the password for the web interface - must be changed during commissioning. 
4. Access point mode only temporarily. The gateway's WLAN access point is intended for commissioning and must be disabled afterwards. 
5. Station mode only in a secured WLAN. If the gateway is integrated into an existing WLAN, that network must meet the security requirements of the automation network. 
6. Web interface accessible only from the administration network. Access must be restricted to a defined address range.
7. Keep firmware up to date. Available security updates must be installed promptly.
8. Neither device constitutes a security boundary. Neither the switch nor the gateway provides access control, network segmentation, or intrusion detection. They do not replace a firewall.

Reasonably Foreseeable Misuse

• Operating the gateway with the factory-set access credentials.
  
• Making the gateway accessible from the Internet, including indirectly via port forwarding.
• Leaving the WLAN access point permanently active, particularly in areas of buildings accessible to the public. 
• Using the switch to separate network areas with different security requirements. An unmanaged switch cannot segment networks.
• Using the gateway as the sole barrier between office IT and the automation network.
• Connecting devices with different security requirements to the same switch infrastructure.