======================================================================== PXS-LU-CSIRT - Vulnerability Notification Form Version 4.0 | 21/07/26 | Sensitivity: Public | TLP: CLEAR ======================================================================== Proximus Luxembourg Cybersecurity Incident Response Team Proximus Luxembourg S.A. - Commercial brand: ProximusNXT ASN: AS56665 Submit to: csirt (at) proximus (dot) lu PGP KeyID: 6E2EA9F8 Encrypt: PGP/GPG encryption strongly recommended RFC 2350: https://www.proximusnxt.lu/en/proximus-luxembourg-csirt Hours: 09h00-17h00 CET, Monday-Friday (excl. LU public holidays) Emergency: telecomsd (at) proximus (dot) lu ------------------------------------------------------------------------ INSTRUCTIONS ------------------------------------------------------------------------ - Fill in all applicable fields below - If reporting multiple related vulnerabilities, duplicate SECTION 3 for each vulnerability and number them (#1, #2, etc.) - If vulnerabilities form a chain, complete SECTION 4 - Attach PoC files separately (list them in SECTION 5) - PGP-encrypt this form before sending Bug Bounty: We value vulnerability reports but do not offer monetary rewards for disclosures. ======================================================================== SECTION 1 - ABOUT THE REPORTER ======================================================================== Company / Organisation : Reporter Full Name : Phone Number : Email Address : PGP Key ID / Fingerprint: PGP Public Key URL : Remain Anonymous? [ ] Yes [ ] No (default) ======================================================================== SECTION 2 - IMPACTED PRODUCT(S) ======================================================================== List all affected products. Copy the block below for additional entries. --- Product Entry 1 --- Vendor : Product : Version(s) Tested : Fixed Version : (if known, otherwise "N/A") Confirmed Vulnerable: [ ] Yes [ ] No --- Product Entry 2 --- Vendor : Product : Version(s) Tested : Fixed Version : Confirmed Vulnerable: [ ] Yes [ ] No --- Product Entry 3 --- Vendor : Product : Version(s) Tested : Fixed Version : Confirmed Vulnerable: [ ] Yes [ ] No ======================================================================== SECTION 3 - VULNERABILITY DETAILS ======================================================================== Duplicate this entire section for each vulnerability reported. Number them: Vulnerability #1, #2, #3, etc. ------------------------------------------------------------------------ 3.1 - Vulnerability Identification ------------------------------------------------------------------------ Vulnerability Ref. Number: (e.g., Vulnerability #1) Vulnerability Type (mark with [X]): [ ] Remote Code Execution (RCE) [ ] SQL Injection [ ] Cross-Site Scripting (XSS) [ ] Cross-Site Request Forgery (CSRF) [ ] Buffer Overflow [ ] Authentication Bypass [ ] Privilege Escalation [ ] Information Disclosure [ ] Denial of Service (DoS) [ ] Path / Directory Traversal [ ] Insecure Deserialization [ ] Server-Side Request Forgery (SSRF) [ ] XML External Entity (XXE) [ ] Command Injection [ ] Cryptographic Weakness [ ] Insecure Data Storage [ ] Other (specify): [ ] Unknown / Unclassified CWE Classification: CWE ID : (e.g., CWE-327) CWE Description : (e.g., Use of a Broken or Risky Cryptographic Algorithm) Reference : https://cwe.mitre.org/data/definitions/.html ------------------------------------------------------------------------ 3.2 - CVSS v3.1 Base Score ------------------------------------------------------------------------ Online calculator: https://www.first.org/cvss/calculator/3.1 Computed CVSS v3.1 Vector String https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N COMPUTED RESULTS: Vector String : CVSS:3.1/AV:_/AC:_/PR:_/UI:_/S:_/C:_/I:_/A:_ Base Score : Severity : [ ] None (0.0) [ ] Low (0.1-3.9) [ ] Medium (4.0-6.9) [ ] High (7.0-8.9) [ ] Critical (9.0-10.0) ------------------------------------------------------------------------ 3.3 - Technical Description ------------------------------------------------------------------------ VULNERABILITY SUMMARY (3-5 sentences): Describe what component is affected, how it can be exploited, and what the impact is. AFFECTED COMPONENT / MODULE / ENDPOINT: Specify the exact component, API endpoint, function, module, or service containing the vulnerability. DISCOVERY METHOD: How the vulnerability was discovered (manual testing, automated scanning, code review, fuzzing, etc.). IMPACT ASSESSMENT: Potential impact on confidentiality, integrity, and availability. Include potential for data breach, system compromise, lateral movement, or service disruption. SUGGESTED REMEDIATION / MITIGATION (if known): ======================================================================== SECTION 4 - VULNERABILITY CHAIN (if applicable) ======================================================================== Complete only if the reported vulnerabilities are related or can be chained together for a greater impact than any single one alone. Example: Vulnerability #1 (weak cipher - CWE-327) combined with Vulnerability #2 (reversible password encoding - CWE-257) enables full credential recovery. CHAIN DESCRIPTION: Explain how the vulnerabilities relate and can be combined. Reference each by its number (#1, #2, etc.) from Section 3. COMBINED IMPACT: How does the chained exploitation differ from exploiting each vulnerability individually? COMBINED CVSS v3.1 (if different from individual scores): Online calculator: https://www.first.org/cvss/calculator/3.1 https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N COMPUTED RESULTS: Vector String : CVSS:3.1/AV:_/AC:_/PR:_/UI:_/S:_/C:_/I:_/A:_ Base Score : Severity : [ ] None (0.0) [ ] Low (0.1-3.9) [ ] Medium (4.0-6.9) [ ] High (7.0-8.9) [ ] Critical (9.0-10.0) EXPLOITATION FLOW / ATTACK PATH: Step-by-step attack path using the chained vulnerabilities. e.g., Step 1: Exploit Vuln #1 to obtain encrypted credentials Step 2: Exploit Vuln #2 to reverse the encryption Step 3: Use recovered credentials for access ======================================================================== SECTION 5 - PROOF-OF-CONCEPT (PoC) CODE & EVIDENCE ======================================================================== HANDLING: All PoC materials are TLP:AMBER. The PXS-LU-CSIRT will never redistribute PoC code without the reporter's explicit authorisation. PoC code is used solely for vulnerability verification and vendor coordination. ------------------------------------------------------------------------ 5.1 - Reproduction Steps ------------------------------------------------------------------------ Provide detailed step-by-step instructions to reproduce the vulnerability. Include environment setup, prerequisites, tools required, and exact sequence of actions. ------------------------------------------------------------------------ 5.2 - PoC Type ------------------------------------------------------------------------ Mark all that apply: [ ] Script / Code (attached separately) [ ] Command-line instructions (included below) [ ] HTTP requests / cURL commands [ ] Screenshots (attached separately) [ ] Video recording (attached separately) [ ] Network capture / PCAP (attached separately) [ ] Log files / Output (attached separately) [ ] Other (specify): ------------------------------------------------------------------------ 5.3 - PoC Code / Commands ------------------------------------------------------------------------ If the PoC is short enough to include inline, paste it below. For longer scripts, attach separately and reference filenames here. --- BEGIN PoC CODE --- --- END PoC CODE --- Language / Runtime : (e.g., Python 3.11, Bash, cURL) Dependencies Required: (e.g., requests, pycryptodome, nmap) ------------------------------------------------------------------------ 5.4 - Attached PoC Files ------------------------------------------------------------------------ List all attached files. For each, provide filename, description, and SHA-256 hash for integrity verification. File 1: Filename : Description : SHA-256 : File 2: Filename : Description : SHA-256 : File 3: Filename : Description : SHA-256 : ------------------------------------------------------------------------ 5.5 - Expected Outcome ------------------------------------------------------------------------ What does successful exploitation look like? What output, access, or state change should be observed when the PoC is executed? ------------------------------------------------------------------------ 5.6 - Test Environment ------------------------------------------------------------------------ Describe the environment used for testing (OS, browser, software version, network configuration, virtualisation, etc.). ======================================================================== SECTION 6 - CREDIT, ATTRIBUTION & PREFERENCES ======================================================================== CREDIT LINE FOR CVE / ADVISORY: How should the discoverer(s) be credited? (e.g., "John Doe, ACME Security" or "Anonymous") EMBARGO / DISCLOSURE PREFERENCE (mark with [X]): [ ] Standard 90-day coordinated disclosure [ ] Extended embargo (longer than 90d - specify reason below) [ ] Immediate disclosure (critical, actively exploited) [ ] No preference - defer to PXS-LU-CSIRT policy Reason for extended embargo (if applicable): ADDITIONAL REFERENCES / LINKS: Any relevant references, blog posts, existing advisories, patches, or external links related to this vulnerability. ======================================================================== SUBMISSION ======================================================================== Please PGP-encrypt this completed form and send it, along with any attached PoC files, to: csirt (at) proximus (dot) lu PGP KeyID: 6E2EA9F8 The PXS-LU-CSIRT will: - Acknowledge receipt within 2 business days - Validate the vulnerability and assess severity - Initiate Coordinated Vulnerability Disclosure (CVD) with vendor - Request a CVE identifier - Coordinate public disclosure within 90 days (or as agreed) ======================================================================== Proximus Luxembourg S.A. | 18, rue du Puits Romain – Z.A Bourmicht | L-8070 Bertrange – Luxembourg | T +352 45 09 15 – 1 | F +352 45 09 11 www.proximusnxt.lu VAT LU 15605033 | RCS Luxembourg B 19.669 | Autorisation d’établissement N°00116315 / 3 | ISO 27001 (Cybersecurity, Housing & Hosting, Managed and Outsourcing Services) & ISO 9001 certifications | Sensitivity: Public / TLP: CLEAR ========================================================================