bTECHNOLOGY - Product Security and CRA Compliance (EU Regulation 2024/2847)

Mottura Serrature di Sicurezza S.p.A. recognises the value of the security research community’s contribution to identifying and responsibly reporting vulnerabilities that may affect its products and services.

Coordinated vulnerability disclosure helps improve product security, protect customers and end users, and ensure that the technical information received is handled properly, confidentially and promptly.

Mottura invites security researchers to report vulnerabilities identified in Mottura products, particularly the bTECHNOLOGY product line and its related hardware, firmware, software, applications, cloud components or associated services.

Reports must be sent to: psirt@mottura.it

Mottura will assess received reports through its internal vulnerability management process and, where necessary, coordinate analysis, validation, mitigation, remediation and communication activities in accordance with applicable legislation.

Mottura is willing to cooperate with security researchers who act in good faith and share the objective of improving product security. Researchers are asked to keep information relating to the vulnerability confidential until the verification activities have been completed and, where necessary, until a corrective or mitigating measure is available.

Premature public disclosure of a vulnerability, without prior coordination with Mottura, could expose customers, users or systems to security risks. Mottura therefore promotes a coordinated disclosure process: the vulnerability should first be reported privately, followed by any public disclosure only after the checks have been completed and corrective or mitigating measures have been defined.

Analysis and resolution times may vary depending on the technical complexity and severity of the vulnerability, the products involved, and the need to test any updates or mitigations. Where possible, Mottura will provide updates on the status of the assessment and the expected timeframe.

Researchers must not carry out activities that could compromise the security, availability or integrity of systems, products, infrastructure, personal data or customer data. In particular, Denial of Service (DoS) activities, unauthorised access, data exfiltration, data alteration, compromise of third-party devices, or any activity not necessary to responsibly demonstrate the vulnerability are not permitted.

Information to include in the report

Where possible, please include the following information in the report sent to psirt@mottura.it:

• the reporter’s first and last name;
• the company or organisation they belong to, if applicable;
• a contact email address;
• any additional contact details;
• a general description of the vulnerability;
• the affected Mottura product, including any relevant product codes;
• the affected hardware, firmware, software, app or service version;
• the components involved, such as the device, mobile app, firmware, cloud portal, API or associated services;
• the configuration, tools or conditions required to reproduce the vulnerability;
• detailed instructions for reproducing the reported behaviour;
• any sample code, Proof of Concept (PoC), logs, screenshots or other useful technical material;
• a description of the potential impact on users, customers, products or systems;
• any mitigations already identified;
• any third parties or other products involved;
• any plans, dates or intentions regarding public disclosure;
• the context of the research being conducted when the vulnerability was discovered.