1. Contact the manufacturer securely (if they have public keys, use those) to alert them of the vulnerability.

2. Demonstrate the exploitation of the vulnerability (without giving the whole thing away)

3. Negotiate timelines. Find out how quickly they can patch the system.

4. Negotiate a bounty. You're not obligated to give them anything without payment.

5. Sign NDA.

6. Deliver evidence of vulnerability.

7. Collect payment.

8. Wait until blackout period is over and the issue has been patched.

9. Publish your report (if allowed under NDA).