Vulnerability Disclosure Policy

Watertech S.p.A.

How to report a security vulnerability in a Watertech product, system or service — and what happens next.

Watertech S.p.A. designs and manufactures smart water and gas meters and the associated data collection systems. The security of our products is inseparable from their metrological and operational reliability.

We welcome the responsible disclosure of security vulnerabilities. If you believe you have identified a security issue affecting our products, systems or services, please report it to us. Every report is acknowledged, assessed and handled under our internal vulnerability handling procedure.

To let us assess the report quickly, please include:

• the product, model and — where known — the firmware or software version affected;
• a description of the vulnerability and its potential impact;
• the steps needed to reproduce it (proof of concept, logs, traffic captures, scripts);
• any CVE identifier already assigned, or public references;
• the name or handle under which you wish to be credited, and how we can reach you.

We accept reports in Italian and English.

We confirm receipt of your report and assign it a unique reference. We then tell you whether the report is confirmed, not reproducible or out of scope, together with the preliminary severity assigned, and we keep you informed of remediation progress until closure.

The timeframes we apply to handling and disclosure are compliant with the Cyber Resilience Act. We agree the advisory publication date with you; it may be brought forward where the vulnerability is actively exploited, or extended in complex cases.

On request, we credit reporters publicly in the security advisory. If you prefer to remain anonymous, please tell us. Watertech does not currently operate a bug bounty programme and does not offer monetary rewards.

This policy covers Watertech-branded smart water and gas meters and their firmware; the associated communication modules and concentrators (NB-IoT, LoRaWAN, wM-Bus); the data management applications and services we provide to our customers; and internet-facing services in Watertech domains.

The following are out of scope:

• denial-of-service (DoS/DDoS) and load testing;
• social engineering directed at Watertech staff, customers or suppliers;
• unauthorised physical access to premises, warehouses or meters installed in the field;
• automated scanner output submitted without a demonstration of impact;
• theoretical weaknesses with no realistic exploitation scenario;
• vulnerabilities in third-party products not integrated into our solutions.

We ask researchers working on our products to:

1. act in good faith and in compliance with applicable law;
2. avoid any action that could affect service availability, the integrity of measurement, or the confidentiality of customer data;
3. limit activity to the minimum necessary to demonstrate the vulnerability, and stop as soon as access is obtained;
4. not access, modify, delete or exfiltrate data belonging to third parties; if personal data is accessed accidentally, stop immediately and tell us;
5. not install backdoors or alter device configuration, and restore the initial state where possible;
6. keep information confidential until the agreed advisory is published.

Watertech regards security research conducted in accordance with the rules above as authorised and valuable. Under those conditions we will not pursue legal action against the reporter and, should a third party do so in connection with that research, we will make it known that the activity was conducted in accordance with this policy. This protection does not extend to activity going beyond what is necessary to demonstrate the vulnerability, nor to activity that causes harm to customers, end users or third parties.

Contact details provided in a report are processed by Watertech S.p.A. as controller, solely to handle the report and meet the related regulatory obligations, under Articles 6(1)(c) and 6(1)(f) of Regulation (EU) 2016/679.