Lantronix is committed to protecting our customers through secure product design and proactive vulnerability management. Consistent with Cyber Resilience Act (CRA), we engage with customers, partners, and security researchers to identify, evaluate, and remediate CVEs through coordinated disclosure practices. Through timely security updates, firmware releases, software patches, and technical support, we are dedicated to expediting the resolution of CVEs and reducing cybersecurity risk throughout the product lifecycle.

Lantronix’s vulnerability disclosure and remediation practices are intended to align with recognized cybersecurity governance and compliance frameworks, including CISA’s Coordinated Vulnerability Disclosure Program, the European Union Cyber Resilience Act, and the CVE Program. These frameworks support documented intake, assessment, coordination, tracking, remediation, and public disclosure of cybersecurity vulnerabilities. Lantronix works to maintain processes that enable responsible coordination with affected stakeholders, including customers, partners, service providers, vendors, and security researchers, while supporting consistent CVE identification and lifecycle-based risk management for products with digital elements.

References: https://www.cisa.gov/resources-tools/programs/coordinated-vulnerability-disclosure-program; https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act; https://www.cve.org/

When submitting a report, please refrain from including sensitive personal information about yourself or your customers. Lantronix is committed to protecting the confidentiality of information you provide and adheres strictly to data protection guidelines to safeguard your data

_{Version 3.0 – August 2026}

_{Disclaimer: Lantronix reserves the right to revise this policy at any time without prior notice. The most current version will always be available on our website. By reporting a vulnerability, you agree to the terms set forth in this policy.}