PHOENIX CONTACT takes the security of the MORYX Framework and its downstream products seriously.
We support Coordinated Vulnerability Disclosure (CVD) and follow the principles described by the EU CSIRTs Network and ENISA. For more information, see:
MORYX follows the .NET LTS release schedule. Security updates are provided during both the Active Support and Maintenance Support phases. For exact dates see the MORYX Release Schedule.
| Version | Status | Security updates until |
|---|---|---|
| 10.x | Active Support | ~ Nov 2030 |
| 8.x | Maintenance Support | ~ Nov 2028 |
| 6.x | Maintenance Support | ~ Nov 2026 |
| < 6.0 | End of Life | — |
Please do not report security vulnerabilities through public GitHub issues, pull requests, or discussions.
Report potential vulnerabilities to the Phoenix Contact Product Security Incident Response Team (PSIRT) using one of the following channels:
- GitHub Private Vulnerability Reporting (preferred): Use the Report a vulnerability button in the Security tab of this repository.
- PHOENIX CONTACT PSIRT: Visit phoenixcontact.com/psirt or send an e-mail to psirt@phoenixcontact.com.
To help us triage your report quickly, please provide as much of the following as possible:
- Type of vulnerability (e.g. SQL injection, authentication bypass, path traversal)
- Affected component(s) and version(s)
- The location of the affected source code (tag, branch, commit, or direct URL)
- Step-by-step instructions to reproduce the issue
- Proof-of-concept or exploit code (if available)
- Impact assessment: how could an attacker exploit this issue?
- Any special configuration required to reproduce the issue
| Step | Target timeframe |
|---|---|
| Acknowledgement of receipt | within 72 hours |
| Initial severity assessment | within 7 days |
| Fix or workaround available | depends on severity and complexity |
| Public disclosure (Security Advisory) | coordinated with the reporter |
We will keep you informed about the progress of the fix and agree on a disclosure date with you before publishing a Security Advisory.
We prefer all communications to be in English or German.
Published security advisories for MORYX Framework are available in the GitHub Security Advisories section of this repository.
For vulnerabilities actively exploited in the wild, PHOENIX CONTACT's PSIRT reports to the competent national authority (BSI / CERT-Bund) within the timeframes mandated by EU Cyber Resilience Act Article 14: 24-hour early warning, 72-hour full notification, 14-day final report.
This policy covers the source code in this repository (PHOENIXCONTACT/MORYX-Framework).
If you are building a product or extension on top of MORYX, you are responsible for the security of your own code and for monitoring your additional dependencies for known CVEs. Please refer to our security integration guidelines for recommended practices.
Under the EU Cyber Resilience Act (CRA), products with digital elements that incorporate MORYX are subject to Article 13 obligations, including providing security updates for the expected product lifetime (minimum five years).