Nanosystems Supremo CVE-2026-121624

The attacker must hold an adjacent-network position relative to a Supremo client (same LAN/Wi-Fi segment or an on-path device) and actively man-in-the-middle the connection, presenting an untrusted/self-signed certificate that the vulnerable client accepts due to improper certificate validation (CWE-295). The client must initiate a Supremo TLS connection during the attack window. Exploitation is LIMITED by: adjacency (not exploitable remotely across the internet, AV:A), high complexity and an additional attack requirement (AC:H/AT:P) reflecting the active MitM positioning and timing needed, and affected versions below 5.0.2.3874 on Windows and macOS. Per the available sources, updating to 5.0.2.3874 or later is the fix.

This is a genuine but conditional risk rather than a drop-everything emergency. The CVSS 4.0 vector (AV:A/AC:H/AT:P/PR:N/UI:N) tells a consistent story: exploitation requires an adjacent network position (not remote over the internet), carries high attack complexity, and has an additional attack requirement (AT:P), while needing no privileges or user interaction. Impact is confidentiality and integrity high (VC:H/VI:H) with no availability impact, matching the description's TLS interception and relay of usernames, SHA-256 password hashes, and license codes. The vuln.today decision label is 'this_week', which aligns with a serious-but-not-critical posture. There is NO CISA KEV listing and NO EPSS score provided in the input, so there is no signal of active or probable mass exploitation; absence of EPSS means probabilistic exploitation likelihood cannot be assessed. A public technical write-up reference exists (pusi77.eu.org blog), reported via VulnCheck, which raises the practical likelihood that attack details are available. Net assessment: a real priority for environments where Supremo is used on untrusted or shared networks, but the adjacency requirement and high complexity meaningfully limit opportunistic, internet-wide attacks.

An attacker positioned on the same local network as a Supremo client (e.g. a shared office LAN, public Wi-Fi, or compromised segment) performs an active man-in-the-middle, presenting a self-signed or otherwise untrusted certificate that the client fails to validate. The client's TLS session is terminated and relayed through the attacker, exposing usernames, SHA-256 password hashes, and license codes. A public technical write-up reference exists; it is not verified as working exploit code, and the high attack complexity reflects the active MitM positioning required.