Report a Product Security Vulnerability
Lincoln Electric takes product security seriously. If you believe you have identified a security vulnerability in a Lincoln Electric product, software, connected system, or related service, please report it to our Product Security Incident Response Team (PSIRT).
Timely reporting helps us review, validate, and address potential security issues that may impact our customers.
How to Report a Vulnerability
Please submit product security vulnerability reports using the form below:
When submitting a report, please include as much information as possible.
Required information:
- Title or short description of the issue
- Description of the vulnerability, weakness, incident, or observed behavior
- Affected Lincoln Electric product, system, software, firmware, service, component, or dependency
- Affected version, build, firmware, configuration, or environment, if known
- Your contact information
- Type of report, such as vulnerability, suspected vulnerability, product security incident, supplier/dependency issue, or other security concern
- Steps to reproduce or supporting evidence, if available
- Potential impact
- Known or suspected exploitation activity
- Public disclosure or external notification status
- EU market or EU customer impact, if known
Helpful supporting information:
- Logs, screenshots, packet captures, crash dumps, proof-of-concept files, advisories, diagrams, or other supporting files
- Any known mitigation or workaround
- Whether the issue has been reported to another vendor, CERT/CSIRT, regulator, or other party
- Whether the issue is already public or planned for public disclosure
What Happens After You Submit:
After your report is received:
- We will acknowledge receipt
- PSIRT will review the submission
- We may contact you for additional information
- If the report is valid and in scope, we will assess impact and determine next steps
Submission of a report does not guarantee that the reported issue constitutes a security vulnerability or will result in a security advisory, update, or other action.
Scope
This reporting channel is intended for product security vulnerabilities and cybersecurity-related concerns involving Lincoln Electric products, software, connected systems, and related services.
For customer support, warranty requests, product defects unrelated to cybersecurity, sales inquiries, or general questions, please use the appropriate Lincoln Electric support channels.
Coordinated Vulnerability Disclosure (CVD)
Lincoln Electric supports coordinated vulnerability disclosure. We ask reporters to work with us in good faith by:
- Reporting vulnerabilities privately through the channels provided above
- Allowing reasonable time for investigation and remediation
- Coordinate public disclosure, when appropriate, with Lincoln Electric
- Avoiding actions that could negatively impact customers, systems, data, safety or operations