Unfortunately, RTX did not respond to our vulnerability report. The account was disabled.
Some sort of acknowledgement of the report certainly would have been good here, but at least they did disable the account. I presume the reported vulnerability no longer exists.
Not worked in aerospace only enterprise but sometimes I worry I'm too cynical and then I remember the things I've seen and think I'm not cynical enough.
That said nothing I work on is aerospace level critical, could cost a lot of money if it's out but no one would ever have died.
They're not in the US. I'm not familiar with German law enforcement practices but I wouldn't be surprised if they had a process that was a little less door-kicky.
I guess they mean you should sell the vulnerability to highest bidder instead of reporting? Weird choice.