CVE-2026-18717

Summary

ASE2000 2.35 through 2.37 is vulnerable to an improper certificate validation vulnerability, which may allow an attacker to impersonate the trusted peer, complete the TLS handshake, and read or modify protected communications.

Affected Software

VendorProductVersion RangeStatus
Applied Systems EngineeringASE2000 V22.25 <= 2.37affected
Applied Systems EngineeringASE2000 V22.38unaffected

Weaknesses

  • CWE-295: CWE-295 Improper certificate validation

Workarounds

Until the upgrade can be applied, the following interim measures reduce exposure:

  • Restrict write access to the ASE2000 installation directory and its configuration files to trusted administrators only.
  • Avoid using IEC 60870-5-104 over TLS across untrusted or shared networks; place ASE2000 hosts on an isolated, segmented network reachable only by intended peers.
  • Ensure the host is protected by a network firewall.

References