CVE-2026-90647
HighCVSS 7.4Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on Windows contains an improper certificate validation vulnerability in the IEC 60870-5-104 TLS client (Task Mode). This allows a network-positioned attacker to bypass certificate validation via a certificate with multiple simultaneous faults, enabling a Man-in-the-Middle attack on protected communications.
Risk Assessment
A network attacker can intercept and modify IEC 60870-5-104 industrial communications, potentially leading to unauthorized control or data falsification in automation systems.
Recommendation
Update ASE2000 software to a version newer than 2.37 if available, or implement additional communication protection mechanisms such as network segmentation and traffic monitoring.
Other vulnerabilities in ASE2000
Original NVD description (English source)
ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on Windows contains an improper certificate validation vulnerability in the IEC 60870-5-104 TLS client (Task Mode). This allows a network-positioned attacker to bypass certificate validation via a certificate with multiple simultaneous faults, enabling a Man-in-the-Middle attack on protected communications.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS