Critical Vulnerabilities Discovered in Applied Systems Engineering ASE2000 V2 Communications Test Set

An industrial control systems advisory (ICSA-26-239-04) published by CISA on August 27, 2026, identifies two significant vulnerabilities in the Applied Systems Engineering ASE2000 V2 Communications Test Set. The affected product is used across critical infrastructure sectors including Chemical, Critical Manufacturing, Energy, and Water and Wastewater, with deployments worldwide.

The first vulnerability, CVE-2018-1285, stems from the Apache log4net library included in ASE2000 versions 2.25 through 2.37. This library does not disable XML external entity processing when parsing configuration files, enabling XXE-based attacks if an attacker can control log4net configuration inputs. Successful exploitation could allow reading or writing arbitrary local files.

The second vulnerability, CVE-2026-18717, affects ASE2000 versions 2.35 through 2.37. It involves improper certificate validation in the IEC 60870-5-104 TLS client. This flaw could allow an attacker to impersonate a trusted peer, complete a TLS handshake, and read or modify protected communications.

Both vulnerabilities carry a CVSS v3.1 base score of 9.8, classified as Critical. ASE/Kalkitech has released version 2.38 which fixes both issues by upgrading the bundled log4net library to 3.3.1.0 and correcting the TLS client certificate validation logic.

Until customers can upgrade, the advisory recommends restricting write access to the ASE2000 installation directory and its configuration files to trusted administrators, avoiding use of IEC 60870-5-104 over TLS across untrusted or shared networks, and protecting hosts with network firewalls.