As a manufacturer of high-quality and durable products, Miele also places the highest demands on the cyber security of its networked devices, apps and web applications. Our specialized cyber security teams are committed to protecting your privacy.
Miele cooperates with the German Federal Office for Information Security (BSI), is a member of the Alliance for Cyber Security, an advisory board member of the CERT@VDE and collaborates with many recognized security experts.
As a manufacturer of high-quality and durable products, keeping user information safe and secure is a top priority and a core company value for Miele. Therefore, we welcome the contribution of external security researchers for improving security of our products and our IT applications. This policy shows the framework that Miele assures with regard to the responsible disclosure of security vulnerabilities. This policy is subject to changes from time to time and is applicable in its latest version.
This policy applies to all networked and networkable products and components developed, produced or marketed by Miele as well as to all publicly accessible IT applications of Miele.
We are interested in findings, which are exploitable, are leading directly to an exploitable vulnerability or allow to remotely compromise user data.
Please note that reports regarding vulnerabilities with minimal security impact (e.g. missing headers), unverified results of automated scans, vulnerabilities beyond Miele’s control and vulnerabilities in violation of the requirements stated below are out of scope.
3. Eligibility and Responsible Disclosure
If you believe, you have discovered a vulnerability in an IT application or have a security incident to report, please send your findings or remarks to the following address:
Ideally, your message should contain the following information:
Description of identified vulnerability
If available: proof-of-concept code, exploit or packet capture
To accelerate the reporting process, we ask that you:
Share the security issue with us in detail;
Be respectful of our applications and systems and do not disrupt operations;
Give us a reasonable time to respond to the issue before publicly disclosing any information. We will try to contact you as soon as possible and eliminate a vulnerability within a period of 90 days. During this time, we ask you to keep all communications and information confidential. We reserve the right to change deadlines based on extreme circumstances;
Do not access or modify our data or our users’ data, without our explicit permission of the owner. Only interact with your own accounts or test accounts for security research purposes;
Contact us immediately if you do inadvertently encounter user data. Do not view, alter, save, store, transfer, or otherwise access the data, and immediately purge any local information upon reporting the vulnerability to the aforementioned e-mail address;
Act in good faith to avoid privacy violations, destruction of data, and interruption or degradation of our services (including denial of service); and
Otherwise, comply with all applicable laws.
4. Consequences of Complying with this Policy
We will not pursue civil action or initiate a complaint to law enforcement for accidental, good faith violations of this policy in its current version. We consider activities conducted consistent with this policy to constitute “authorized” conduct. To the extent, that your activities are inconsistent with certain restrictions in our Policy, we waive those restrictions for the limited purpose of permitting security research under this policy. We will not bring a claim against you for circumventing the technological measures we have used to protect the applications in scope.
We would like to thank you as an important contributor. Your hints and messages support us in making our systems more secure. We would like to express our gratitude and welcome you to our Hall of Fame. Please let us know if and under which name we can list you there.
Hall of Thanks
Miele would like to thank all persons and organizations who have contributed to improve the security of the devices, apps and web applications.