This page collects what you need in order to run the openXEdge safely: where to report a security problem, how long you get updates, what to do at commissioning and decommissioning, which network ports are open, and what data the device processes.
Reporting a vulnerability
If something about the openXEdge looks like a security problem, please report it to:
Anything that helps us reproduce it is useful: the firmware version (Settings → Update), the serial number (the machine ID on older devices), what you did and what happened.
Our commitment. Anyone who reports a vulnerability to us in good faith has no legal action to fear from us. We confirm receipt, keep you posted, and credit you when we close the gap if you want us to. Please give us time to fix the problem before you publish the details.
You can hold us to this:
- You receive an acknowledgement within 5 working days.
- Within 15 working days we tell you whether the openXEdge is affected, how severe we rate the vulnerability and how we intend to proceed.
- Please publish details no earlier than 90 days after your report or once the fix has shipped, whichever comes first.
If you suspect a vulnerability is already being exploited, say so explicitly — shorter deadlines apply to those.
How long you get security updates
Brinkhaus provides security updates for the openXEdge firmware and the container stack shipped with it through the signed update channel for five years from the delivery of the individual device.
In detail:
- The period starts when your device is delivered, not when the product was launched. Two devices can therefore have different end dates.
- If a device is replaced, the replacement starts a period of its own.
- It covers the firmware and the services shipped with it. It does not cover applications you install yourself from the AppStore — those are covered by whatever their own vendor promises.
- The commitment applies to firmware from version 2 onwards. Devices still on the old 1.1 line are excluded and should be migrated; talk to us.
How security updates reach the device
Security updates arrive the same way as any firmware update: you pick a version in the settings, the edge downloads it from the update server and verifies its digital signature before installing. If the signature does not match, nothing is installed. If the installation fails, the edge returns to the previous state by itself.
How updates work describes the sequence in detail. If your edge cannot reach the update server, there is also the USB route — with the same signature check.
We mark security-relevant changes in the release notes, which you can read before installing.
Secure commissioning
Two things are worth doing right away:
- Change the initial password. Every edge gets its own initial password. On devices with a serial number it is on the label or delivery note and cannot be worked out from the serial number alone. On older devices the activation shows it once; it is derived from the machine ID and therefore not a secret: anyone who knows the method and the machine ID can work it out. Either way, change it when you first sign in. Devices with a serial number require it after the first sign-in with the label password; older devices do not force it. → Change password
- Create individual user accounts instead of sharing one. Only then does the audit trail tell you afterwards who changed what. Every password someone sets must meet the password policy (in the GMN stream from gmn-2.45.2), by default at least 10 characters. An admin can tighten it there. → Manage users
Beyond that, safe operation assumes the edge sits in a protected company or plant network and is not reachable from the internet. Do not set up port forwarding to the device. For remote access, use the encrypted route.
Secure decommissioning
When a device is retired, returned or passed on:
- Erase the data. All recorded measurements, settings and credentials live on the built-in disk. Reinstalling from a USB stick writes a complete image to that disk and overwrites it in the process. If the medium has to be erased verifiably and without residue — when returning it to a third party, for instance — that is not enough; plan for a full overwrite or physical destruction of the medium. We will help you with that.
- Request removal from fleet management. The device cannot deregister itself. Write to security@brinkhaus-gmbh.de or to your contact, and we will remove the record and its log data.
- Check your own integrations. If you wired the edge into your own systems (an MQTT feed on port 1883, for example), remove those entries.
Open network ports
These ports are reachable from outside in the delivered state. Every other service — database, Grafana, DataStore, update service — is reachable only inside the device and cannot be addressed from outside. From the software state with maintenance service 1.22 on (GMN: firmware 2.45), a firewall on the device enforces this: it drops every connection to a port that is not on the allow-list. You may close the system ports 22, 5000, 5443 and 1883 yourself and open further ports yourself — see Configure the firewall.
Your product functions
| Port | Purpose | Note |
|---|---|---|
| 5000/tcp | Operator interface, unencrypted | The kiosk screen uses it too |
| 5443/tcp | Operator interface, encrypted | The recommended route; certificate from the device’s own edge CA or your company CA, see Remote access (HTTPS). |
| 8050/tcp | IDEA-4S bridge | Blocked from the network by the firewall; meant for the applications on the device. The service additionally decides who may read and who may write, by source address. |
| 8082/tcp | IO-Link relay | Blocked from the network by the firewall until you open it by rule for a DataStore outside the edge; the relay additionally checks the source address against its allow list. |
| 1883/tcp | MQTT broker | No authentication, no encryption. Anyone who reaches this port can read every measurement and inject their own. The interface is deliberately open so your own systems can subscribe — which is exactly why it belongs in a protected network. |
Base system services
| Port | Purpose |
|---|---|
| 22/tcp | Maintenance access for the Brinkhaus service, key-based login only |
These base-system services run on the device but are blocked from outside by the firewall; they are needed only inside the device:
| Port | Purpose |
|---|---|
| 80, 443/tcp | The AppStore’s distributor to the installed applications — the operator interface embeds the AppStore through its own port. |
| 8951/tcp | AppStore service. |
| 8085/tcp | Self-diagnosis of the security agent, read by the operator interface. |
| 631/tcp | Print service. It comes along as a dependency of the kiosk browser and is not needed to run the edge |
Applications from the AppStore open ports of their own. Those are blocked from outside too until you open them in the firewall; through the edge’s operator interface you reach the applications without an allowance. Before maintenance service 1.22 (GMN: firmware 2.45) there was no firewall — on such devices the ports listed here as blocked are open.
What data the edge processes
On the device are the measurements from your sensors and machines, the settings, and the user accounts of the operator interface. You decide yourself how long measurements are kept.
To fleet management go operating data only: version levels, IP addresses, the time of the last heartbeat, self-diagnosis codes, serial number, device name and inventory number, and whether the initial password has been changed (never the password itself). No sensor measurements, no process data, no personal data. The connection always runs outbound from the edge; no port is opened from outside.
More on this: Fleet onboarding.
What the product is, and what it is protected against
The openXEdge is a device for condition monitoring of production machines: it records sensor and process values, stores them and displays them. It does not control the machine and is not part of a safety chain.
We protect four things, in this order of precedence:
- Recording keeps running — even when the network fails, a plug is pulled or a service crashes.
- Only our software reaches the device — every update is signed and verified before installation.
- Credentials stay on the device.
- Interventions are traceable — sign-ins, sign-outs and changes are logged.
Where availability and hardening conflict, availability wins: a device that stops measuring is of no use on a shop floor. Those trade-offs are written down and justified.
Software bill of materials (SBOM). For every released version we keep a complete list of the software components it contains, in CycloneDX format. You can have it on request to security@brinkhaus-gmbh.de within ten working days; please quote your device’s firmware version.
Declaration of conformity. The supplier declaration for your device is a separate, printable page in this documentation.
We provide the full EU declaration of conformity and the technical documentation on request.