This question already has an answer here:
I accidently discovered a misconfiguration (?) security vulnerability: Workstation managing system is publicly exposed with default credentials. admin/admin
The system contains arround 2k workstations with functionality such as software deployment, wiping, remote device control, etc.
I really would like to inform the company, not sure what is the best way to do that?
Is it okay to use for example hackerone or some similar service? Should I just send the email? If so to whom?
I am not sure if by trying that login combination I did not violated any laws? I found the system by a search engine, when was looking for the product demo.
Edit: I researched some topics about disclosing. Basically all of them recommends to contact the vendor in some polite matter. The thing is that everything seems to be ok from the vendor and product side, the user simply did not comply with security best practices by changing the credentials
Edit: I do not believe this is duplicate of: How to disclose a security vulnerability in an ethical fashion?
I think that for the following reasons: It is not related to a bug of a vendor application affecting multiple customers. It is basically a misconfiguration of a system, which allows exposure of underlying system to the public. Everything is ok with the product they are using. Since it was accidental, possibly there might be a different law regulations prohibittng to even accessing their system, depending on which country the system is hosted in. This is simply a moral question, cause in my personal opinion it feels right to notify the affected company, better than letting it slide