Lantronix is committed to protecting our customers through secure product design and proactive vulnerability management. Consistent with Cyber Resilience Act (CRA), we engage with customers, partners, and security researchers to identify, evaluate, and remediate CVEs through coordinated disclosure practices. Through timely security updates, firmware releases, software patches, and technical support, we are dedicated to expediting the resolution of CVEs and reducing cybersecurity risk throughout the product lifecycle.

Lantronix’s vulnerability disclosure and remediation practices are intended to align with recognized cybersecurity governance and compliance frameworks, including CISA’s Coordinated Vulnerability Disclosure Program, the European Union Cyber Resilience Act, and the CVE Program. These frameworks support documented intake, assessment, coordination, tracking, remediation, and public disclosure of cybersecurity vulnerabilities. Lantronix works to maintain processes that enable responsible coordination with affected stakeholders, including customers, partners, service providers, vendors, and security researchers, while supporting consistent CVE identification and lifecycle-based risk management for products with digital elements.

References: https://www.cisa.gov/resources-tools/programs/coordinated-vulnerability-disclosure-program; https://digital-strategy.ec.europa.eu/en/policies/cyber-resilience-act; https://www.cve.org/