ASE2000 test set needs immediate patch for XXE, TLS flaws
The TLS fix doesn't just close a hole, it corrects certificate validation logic that let an attacker complete the handshake and impersonate a trusted peer.
TL;DR
CISA is alerting operators of Applied Systems Engineering ASE2000 V2 Communications Test Sets that versions 2.25 through 2.37 carry two critical vulnerabilities: an XXE flaw (CVE-2018-1285, CVSS 9.8) in the bundled log4net library that allows remote code execution, and improper TLS certificate validation (CVE-2026-18717, CVSS 7.4) that lets an attacker impersonate a trusted peer on IEC 60870-5-104 connections. Upgrade to v2.38 fixes both. The vendor offers interim mitigations (restricting write access to config files and isolating affected hosts) until the patch is applied.
CISA published ICS advisory ICSA-26-239-04 flagging two vulnerabilities in the ASE2000 V2, a communications test set used in chemical, critical manufacturing, energy, and water/wastewater environments. Both flaws were reported to CISA by researcher Enoch Wang.
The higher-severity issue is CVE-2018-1285, an XXE vulnerability in Apache log4net versions prior to 2.0.10 that's been bundled with ASE2000 since version 2.25. The CVE dates to 2018, this isn't new, it's newly surfaced in this product. Successful exploitation lets an attacker read or write arbitrary local files and cause the application to issue outbound network requests, all without authentication. CVSS v3 assigns a 9.8.
The second vulnerability, CVE-2026-18717, is a certificate validation failure in the IEC 60870-5-104 TLS client. An attacker can impersonate a trusted peer, complete the TLS handshake, and read or modify protected communications. CVSS v3 scores it 7.4, though CVSS v4 bumps it to 9.1, the difference reflecting version-4's assessment that the attack complexity is low rather than high once network access is achieved.
What the upgrade does
Version 2.38 upgrades the bundled log4net to 3.3.1.0 and corrects the certificate validation logic so that error conditions are properly evaluated rather than bypassed. ASE/Kalkitech directs customers to www.ase-systems.com for upgrade instructions and documentation, with support available at support@ase-systems.com.
Until you patch
The advisory includes interim mitigations that reflect the operational reality of these devices. Restrict write access to the ASE2000 installation directory and its configuration files to trusted administrators only, that limits the XXE attack surface by preventing attackers from dropping malicious log4net configuration files. Avoid running IEC 60870-5-104 over TLS across untrusted or shared networks; place ASE2000 hosts on an isolated, segmented network reachable only by intended peers. Standard ICS hardening (firewalls, network segmentation, no internet exposure) applies as always.
No timeline for patch rollout beyond "contact support" is specified, though the upgrade package exists now. For organizations running these test sets on air-gapped or heavily firewalled networks, the interim measures may buy time. For anyone with ASE2000 on a routable network, the XXE vector at 9.8 doesn't leave much room to wait.
Published ·Deep Fathom