CISA flags critical flaws in Applied Systems Engineering ASE2000 test set

By Atlas Watchline Staff · Regulatory · August 27, 2026

CISA said Applied Systems Engineering’s ASE2000 V2 Communications Test Set has two vulnerabilities in versions 2.25 through 2.37 and should be upgraded to 2.38 or later.

CISA on Aug. 27 issued an industrial control systems advisory for Applied Systems Engineering ASE2000 V2 Communications Test Set, saying versions 2.25 through 2.37 are affected by two vulnerabilities and should be upgraded to version 2.38 or later.

CISA said successful exploitation could let an attacker read or write arbitrary local files, trigger outbound network requests, or intercept a TLS connection and impersonate a trusted peer to read or alter protected communications.

What CISA said

CISA identified the flaws as CVE-2018-1285 and CVE-2026-18717. For CVE-2018-1285, the agency said Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files, which can allow XXE-based attacks in applications that accept attacker-controlled configuration files. CISA listed that issue as CWE-611, with a CVSS v3.1 base score of 9.8 and a CVSS v4.0 base score of 9.2.

For CVE-2026-18717, CISA said ASE2000 versions 2.35 through 2.37 have improper certificate validation that may allow an attacker to impersonate the trusted peer, complete the TLS handshake, and read or modify protected communications. CISA listed that issue as CWE-295, with a CVSS v3.1 base score of 7.4 and a CVSS v4.0 base score of 9.1.

Context and background

CISA said ASE/Kalkitech provides version 2.38 as the fixed release. The agency said that release upgrades the bundled log4net library to version 3.3.1.0 and corrects the IEC 60870-5-104 TLS client certificate validation logic.

The advisory says all customers running ASE2000 versions 2.25 through 2.37 are affected. It also lists the product as deployed worldwide, with related critical infrastructure sectors including Chemical, Critical Manufacturing, Energy, and Water and Wastewater.

CISA said Enoch Wang reported the vulnerabilities to the agency. It also said no known public exploitation specifically targeting these issues has been reported to CISA at this time.

What happens next

CISA recommended restricting write access to the ASE2000 installation directory and configuration files to trusted administrators, avoiding IEC 60870-5-104 over TLS across untrusted or shared networks, and placing ASE2000 hosts on an isolated, segmented network reachable only by intended peers. The agency also said hosts should be protected by a network firewall.

CISA directed users to upgrade to version 2.38 or later and said upgrade instructions and user documentation are available from ASE Systems.

Sources

• CISA Cybersecurity Advisories
• CISA CSAF

Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.

This is the AMP version of the article. Read the full article on Atlas Watchline.