As cited
Copy frozen at (site build).
vulnerabilities
Applied Systems Engineering ASE2000 V2 Communications Test Set
No summary had been written when this copy was frozen.
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Applied Systems Engineering ASE2000 V2 Communications Test Set
Applied Systems Engineering released a security advisory for the ASE2000 V2 Communications Test Set covering versions 2.25 through 2.37, which contain an XML external entity (XXE) vulnerability in the bundled log4net library (CVE-2018-1285) and an improper certificate validation vulnerability in IEC 60870-5-104 TLS handling (CVE-2026-18717). The XXE flaw could allow remote code execution and arbitrary file access, while the certificate validation issue enables man-in-the-middle attacks on protected communications. Version 2.38 is available as a fix, upgrading log4net to version 3.3.1.0 and correcting the TLS validation logic.
Why it matters: Critical infrastructure operators in chemical, manufacturing, energy, and water sectors using ASE2000 versions 2.25 through 2.37 must upgrade to version 2.38 immediately to prevent remote exploitation and communications interception, as these vulnerabilities carry CVSS v3.1 scores of 9.8 and 7.4 respectively.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Applied Systems Engineering ASE2000 V2 Communications Test Set
Applied Systems Engineering released a security advisory for the ASE2000 V2 Communications Test Set covering versions 2.25 through 2.37, which contain an XML external entity (XXE) vulnerability in the bundled log4net library (CVE-2018-1285) and an improper certificate validation vulnerability in IEC 60870-5-104 TLS handling (CVE-2026-18717). The XXE flaw could allow remote code execution and arbitrary file access, while the certificate validation issue enables man-in-the-middle attacks on protected communications. Version 2.38 is available as a fix, upgrading log4net to version 3.3.1.0 and correcting the TLS validation logic.
Why it matters: Critical infrastructure operators in chemical, manufacturing, energy, and water sectors using ASE2000 versions 2.25 through 2.37 must upgrade to version 2.38 immediately to prevent remote exploitation and communications interception, as these vulnerabilities carry CVSS v3.1 scores of 9.8 and 7.4 respectively.
- Source published
- First seen by Cybersecurity Tracker