I would report this using the responsible disclosure program of the manufacturer.