Product Security

Home » Contact » Product Security

HMH Systems AG monitors the software of its machines and the third-party components they use (e.g. SIGMATEK controllers, software libraries, operating system) throughout the support period. We assess reported vulnerabilities in a structured way and inform affected customers directly. This is based on EU Regulation 2024/2847 (Cyber Resilience Act, CRA).

Security Advisories

When a vulnerability in one of our products is confirmed and a fix or mitigation is available, we publish a security advisory: Security Advisories.

Report a vulnerability or security incident

Please report potential vulnerabilities, actively exploited vulnerabilities and severe security incidents in products of HMH Systems AG (SYPRO Feeder, SYPRO Sorter and SYPRO ProdLift machines, SYPRO-QT-HMI operating software, SYPRO IoT-Gateway) by email to:

We acknowledge receipt within 3 working days. Please do not send exploit code or confidential plant data in your first message: if needed, we will agree on a secure channel with you. Do not send personal data of third parties or customer data.

Please use only this address for such reports, not the addresses of sales, service or support.

What helps us

Affected product, machine number, software or firmware version
Description of the vulnerability and its likely impact
Steps to reproduce, e.g. a log excerpt or screenshot
Whether the vulnerability is already being exploited or is publicly known
Configuration and environment (e.g. how the machine is connected to the network)
Your contact details

How we proceed

We review your report and inform you of the result and the planned measures.
We provide security updates to our customers free of charge.
We inform affected customers directly, then publish a security advisory no later than 90 days after the report, unless agreed otherwise.
On request, we credit you as the reporter in the advisory.

Please do not disclose details before our advisory is published, and do not run tests on third-party systems in production.

Alternative reporting channels

If you prefer not to contact us directly or want to involve an independent body, you can use the ENISA Single Reporting Platform or your national CSIRT; in Switzerland, the Federal Office for Cybersecurity (FOCS).

Reporting obligations under the CRA

Since 11 September 2026, manufacturers must report actively exploited vulnerabilities and severe security incidents to the authorities. This obligation lies with HMH Systems AG as the manufacturer, not with the users. We report via the ENISA Single Reporting Platform and inform our customers directly at the same time.