Zoomlion operates a Coordinated Vulnerability Disclosure (CVD) programme. We welcome security researchers, users and supply-chain partners to report product cybersecurity issues responsibly through our official channel. We will acknowledge, assess and handle valid reports within committed timelines, and restrict public release of exploit details until a fix is available and users have a reasonable deployment window—protecting users in the field and the safety of operations. Good-faith research under this policy is covered by our Safe Harbour. Publishing technical details requires written permission, or expiry of the non-disclosure period with PSIRT notified. Report to: vsoc_wlaq@zoomlion.com. 

Full policy: Coordinated Vulnerability Disclosure Policy (ZL-SEC-CVD-001).