SEC Consult Vulnerability Lab Responsible Disclosure Policy and CNA Status

Key Information Vulnerability Management Vulnerability Lab: SEC Consult has established its own internal security laboratory to maintain an international competitive edge against attackers in the fields of cybersecurity and application security. This lab supports high-quality penetration testing and evaluation of new technologies, and provides clients with up-to-date information on security vulnerabilities and risk assessments for emerging technologies. Responsible Disclosure Policy SEC Consult follows a responsible disclosure policy, ensuring timely provision of necessary information and timeframes to vendors to verify and fix security vulnerabilities, while coordinating the public release of security advisories. Contact Information Contact the Vulnerability Lab via security-research@sec-consult.com. PGP key fingerprint: F9A9D4AF3DC2D298835090252D2DD7B5C6EE883F available for download. CNA Status SEC Consult Vulnerability Lab is a CVE Numbering Authority (CNA), assigning CVE identifiers to all third-party hardware/software vulnerabilities discovered by the lab that fall outside the scope of other CNAs. Recent Vulnerabilities A list of multiple vulnerabilities discovered in recent months, including: - October 29, 2025: Unprotected NFC card manipulation leading to free top-up in GiroWeb Cashless Catering Solutions of legacy customer infrastructure. - October 21, 2025: Multiple Vulnerabilities in EfficientLab WorkExaminer Professional. - September 8, 2025: NFC Card Vulnerability Exploitation Leading to Free Top-Up in KioSoft "Stored Value" Unattended Payment Solution (Mifare). - etc., each with corresponding dates and brief descriptions.

Goal Reached Thanks to every supporter — we hit 100%!

SEC Consult Vulnerability Lab Responsible Disclosure Policy and CNA Status