CVE-2026-90647

Improper Certificate Validation in ASE2000 V2 Communication Test Set Enables MITM

Published Sep 12, 2026 CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Description

ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on Windows contains an improper certificate validation vulnerability in the IEC 60870-5-104 TLS client (Task Mode). This allows a network-positioned attacker to bypass certificate validation via a certificate with multiple simultaneous faults, enabling a Man-in-the-Middle attack on protected communications.

Analysis

Technical impact

The vulnerability is an improper certificate validation flaw (CWE-295) in the IEC 60870‑5‑104 Task Mode TLS client of the ASE2000 V2 Communication Test Set. A device positioned on the network can supply a certificate containing multiple simultaneous faults, leading the client to accept it and establish TLS sessions without proper validation. This flaw enables a malicious actor to perform a Man‑in‑the‑Middle attack on protected communications, potentially compromising confidentiality and integrity of the monitored processes.

Affected Systems

Kalkitech’s ASE2000 V2 Communication Test Set software versions 2.35 through 2.37 running on Windows is affected. Users of these specific firmware releases should verify the installed version and consult the vendor advisory.

Risk and Exploitability

The CVSS score of 9.1 signals a critical threat. The EPSS score is <1%, indicating a low probability of exploitation, and the vulnerability is not listed in the CISA KEV catalog. The attack is feasible from any position that can present a forged TLS certificate to the client, making MITM possible without additional constraints.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Kalkitech

ASE2000 V2 Communication Test Set

unaffected

Version	Status	Constraints
`2.35`	affected	< 2.38

No data.

Vendor Product Versions

Kalkitech

Ase2000 V2 Communication Test Set

Version	Status	Scheme	Platform
`[2.35,2.38)`	affected	generic	['windows']

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Check Kalkitech’s website or contact support for an official patch to tighten certificate validation in the IEC 60870‑5‑104 TLS client.
When a patch becomes available, install it on all ASE2000 V2 units that run Windows versions 2.35 to 2.37.
If a patch cannot be applied immediately, configure the system to reject encrypted traffic for anomalous certificate chains.

Generated by OpenCVE AI on September 15, 2026 at 18:27 UTC.

Tracking

Advisories

No advisories available

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.214% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://www.ase-systems.com/wp-content/uploads/2026/07/CYB_2026_86278_Advisory_v1.0.pdf

History

Sep 15, 2026 6:45 PM Title updated View changes

Type	Values Removed	Values Added
Title		Improper Certificate Validation in ASE2000 V2 Communication Test Set Enables MITM

Sep 15, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 15, 2026 3:00 AM Title updated View changes

Type	Values Removed	Values Added
Title	Improper Certificate Validation in IEC 60870‑5‑104 TLS Client

Sep 14, 2026 9:00 PM Title updated View changes

Type	Values Removed	Values Added
Title		Improper Certificate Validation in IEC 60870‑5‑104 TLS Client

Sep 14, 2026 6:00 AM Title updated View changes

Type	Values Removed	Values Added
Title	Improper Certificate Validation in IEC 60870-5-104 TLS Client Enabling Man‑in‑the‑Middle Attack

Sep 13, 2026 9:00 PM Title updated View changes

Type	Values Removed	Values Added
Title		Improper Certificate Validation in IEC 60870-5-104 TLS Client Enabling Man‑in‑the‑Middle Attack

Sep 13, 2026 8:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Kalkitech Kalkitech ase2000 V2 Communication Test Set
Vendors & Products		Kalkitech Kalkitech ase2000 V2 Communication Test Set

Sep 13, 2026 1:00 PM Title updated View changes

Type	Values Removed	Values Added
Title	Improper Certificate Validation in IEC 60870‑5‑104 TLS Client Allows MITM

Sep 13, 2026 12:30 AM Title updated View changes

Type	Values Removed	Values Added
Title		Improper Certificate Validation in IEC 60870‑5‑104 TLS Client Allows MITM

Sep 12, 2026 10:45 PM Description updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on Windows contains an improper certificate validation vulnerability in the IEC 60870-5-104 TLS client (Task Mode). This allows a network-positioned attacker to bypass certificate validation via a certificate with multiple simultaneous faults, enabling a Man-in-the-Middle attack on protected communications.
Weaknesses		CWE-295
References		https://www.ase-systems.com/wp-content/uploads/2026/07/CYB_2026_86278_Advisory_v1.0.pdf
Metrics		cvssV3_1 `{'score': 7.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'}` cvssV4_0 `{'score': 9.1, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N'}`