CVE-2026-18717

Deferred Deferred - Pending Action

Improper Certificate Validation in ASE2000

Publication date: 2026-08-28

Last updated on: 2026-08-31

Assigner: ICS-CERT

Description

ASE2000 2.35 through 2.37 is vulnerable to an improper certificate validation vulnerability, which may allow an attacker to impersonate the trusted peer, complete the TLS handshake, and read or modify protected communications.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-31

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-18717

EUVD

EUVD-2026-67309

Affected Vendors & Products

Vendor	Product	Version / Range
ase_systems	ase2000	From 2.35 (inc) to 2.37 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-295	The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

Executive Summary

CVE-2026-18717 is an improper certificate validation vulnerability in ASE2000 versions 2.35 through 2.37. It allows an attacker to impersonate a trusted peer, complete the TLS handshake, and potentially read or modify protected communications.

Detection Guidance

To detect this vulnerability, check the ASE2000 version installed on your system. If it is version 2.35 through 2.37, the system is vulnerable. Use commands like 'ase2000 --version' or inspect the software installation directory for version details.

Impact Analysis

This vulnerability may allow attackers to intercept, read, or alter sensitive communications protected by TLS. It could lead to unauthorized access to systems, data breaches, or manipulation of industrial control systems if exploited.

Compliance Impact

This vulnerability may lead to unauthorized access to protected communications, potentially exposing sensitive data. For GDPR, this could result in violations of data confidentiality and integrity requirements. For HIPAA, it may compromise protected health information during transmission. Organizations using affected ASE2000 versions must address this flaw to maintain compliance with these regulations.

Mitigation Strategies

Immediately upgrade ASE2000 to version 2.38 or later, which includes corrected TLS client certificate validation logic. Until the upgrade is applied, restrict write access to the installation directory, avoid using IEC 60870-5-104 over TLS on untrusted networks, and ensure network firewall protection is in place.

Hi! I’m here to help you understand CVE-2026-18717. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70