NISSEI ASB MACHINE CO., LTD. and its affiliated companies (hereinafter "ASB Group" or “We”) is committed to ensuring the security of its products and services and protecting customers from cyber threats.
To this end, we collect and disclose information regarding product vulnerabilities.

1. Product Vulnerability Management

We have established a Product Security Incident Response Team (PSIRT) to address vulnerabilities related to its products.
The PSIRT collects information on product security vulnerabilities from various sources and identifies and mitigates risks based on this information.

2. Applicable Products

This policy applies to products manufactured or marketed (e.g. Auxilliary Equipment, spare parts) by us and applications provided by us that are used in conjunction with those products (hereinafter referred to as "Applicable Products").

3. Exclusions

The following types of vulnerabilities are excluded from reporting:

• Vulnerabilities already known to us and for which countermeasures have been publicly disclosed.
• Social engineering attacks impersonating us.
• Vulnerabilities detected by automated scanning tools that have not been manually verified.

4. Bug Bounty Program

Regardless of the content of the vulnerability information (hereinafter referred to as "Vulnerability Information"), we do not offer any rewards (monetary or otherwise) to individuals or entities who report vulnerabilities (hereinafter referred to as "Reporters").

5. Handling of Vulnerability Information

5.1. Submission

The reporting form is for vulnerability submissions only.
We check the report and send an acknowledgment email to the specified email address without delay.

5.2. Initial Response

Upon receiving a report, we will review the content.Please note that we may utilize Artificial Intelligence (AI) tools to assist in the initial triage and technical analysis of the report. However, all final evaluations and decisions will be made by human personnel. If the reported issue is determined to be a new vulnerability, we will promptly notify the Reporter via the specified email address.

5.3. Investigation, Response, and Disclosure

Progress updates will be provided as necessary. If the issue is confirmed as a new vulnerability, we will coordinate with relevant parties* to determine the disclosure date and publish a security advisory once preparations are complete.
Additional information may be requested during the investigation process, and cooperation is appreciated.
*Relevant parties may include:

• The Reporter
• Internal stakeholders (e.g., technical, public relations, legal departments)
• External stakeholders (e.g., suppliers, authorities and agencies such as JPCERT/CC and ENISA)

6. Vulnerability Countermeasures

In responding to vulnerabilities and security incidents, we may collaborate with government agencies as necessary to provide information to customers.
Vulnerability information and countermeasures will be disclosed at an appropriate time.
If a vulnerability is deemed to potentially affect specific customers, we may contact them individually.

7. Rights Regarding Reported Vulnerability Information

By submitting Vulnerability Information to us, the Reporter agrees to the following:

• The Reporter represents and warrants that they have the legal right to report the Vulnerability Information and that it does not infringe upon the rights of any third party.
• The Reporter shall not exercise moral rights of authorship against we or any party that inherits or is licensed such rights from us, nor shall the Reporter cause any author to exercise such rights.
• The Reporter hereby grants us a worldwide, non-exclusive, royalty-free, sublicensable, and transferable license to use the Vulnerability Information and any associated intellectual property rights.
• This license includes, but is not limited to, the right to:
  • develop and publish countermeasures and workarounds based on the Vulnerability Information;
  • modify and improve existing products;
  • develop, manufacture, commercialize, sell, and distribute products that have been modified, improved, or newly developed based on the Vulnerability Information.
• The Reporter agrees not to disclose or use any part of our response to the report without prior consent.

8. Handling of Personal Information and Contact Information

Personal information will be handled in accordance with our Privacy Policy outlined below.

• Personal Information Protection Policy
  https://www.nisseiasb.co.jp/en/privacy-policy/

Contact Information for Vulnerability Reporting

If you have identified a potential security vulnerability in a product supported by Corporate Group, please report it to the email address provided at the bottom of this section. Before sending your report, please carefully read the following important notices and required information.

Required Information

When reporting, please be sure to include the following information in your email.Please note that inquiries with missing required information will not receive a response.

• Reporter Name
• Contact Email Address
• Company Name Where the Machine is Installed (Enter "None" for vulnerability findings not associated with an actual machine)
• Product Name (Model Name)
• Machine Serial Number
• Solution Name / Other Connected Products / Serial Number
• Program Name (Product Version Number and Model Number)
• Network Connection Status and Configuration
• Details of the Vulnerability

Detailed Information

To ensure accurate investigation and resolution, please also include as much of the following information as possible:

• CWE ID and nature of the vulnerability (e.g., CWE-120: Buffer Overflow)
• Potential impact of the vulnerability
• Steps to reproduce the vulnerability
• Proof-of-concept code or exploit details, if available

Contact Email