ASE2000 V2 Communications Test Set - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/ase2000-v2-communications-test-set/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 27 Aug 2026 16:05:01 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCritical Vulnerabilities in Applied Systems Engineering ASE2000 V2https://feed.craftedsignal.io/briefs/2026-08-ase2000-vulnerabilities/Thu, 27 Aug 2026 16:05:01 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-08-ase2000-vulnerabilities/Applied Systems Engineering ASE2000 V2 (versions 2.25-2.37) is affected by critical XXE and improper TLS validation vulnerabilities that allow for remote code execution, arbitrary file access, and man-in-the-middle attacks.Applied Systems Engineering (ASE) has disclosed critical security vulnerabilities affecting the ASE2000 V2 Communications Test Set, specifically versions 2.25 through 2.37. These flaws pose significant risks to industrial control environments, including the Energy, Chemical, and Water/Wastewater sectors. The vulnerabilities include an XML External Entity (XXE) injection flaw (CVE-2018-1285) due to an outdated log4net library, which enables local file read/write operations and potential arbitrary command execution. Additionally, a flaw in the IEC 60870-5-104 TLS implementation (CVE-2026-18717) allows for improper certificate validation, permitting attackers to impersonate trusted peers and intercept or modify sensitive industrial communications. Impacted organizations are urged to upgrade to version 2.38 immediately, which resolves both issues and updates the underlying log4net dependencies.

Impact

Successful exploitation of these vulnerabilities allows unauthorized actors to read or write arbitrary local files, trigger malicious outbound network requests, and intercept encrypted communications via man-in-the-middle attacks. These capabilities jeopardize the integrity and availability of industrial processes globally, potentially leading to unauthorized control of communication streams or system compromise. Organizations relying on ASE2000 for critical infrastructure operations are at high risk if these systems remain internet-exposed or reside on untrusted, shared segments.

Recommendation

  • Upgrade all instances of ASE2000 V2 to version 2.38 or later immediately to patch CVE-2018-1285 and CVE-2026-18717.
  • Restrict write access to the ASE2000 installation directory and configuration files to prevent the placement of malicious log4net configuration files used to trigger CVE-2018-1285.
  • Isolate hosts running ASE2000 into segmented networks with strict firewall controls, ensuring they are not reachable from the public internet or untrusted enterprise network segments.
  • Disable or avoid the use of IEC 60870-5-104 over TLS on networks where traffic cannot be fully trusted, pending system upgrades.
]]>criticaladvisory