ASE2000 V2 EUVD-2026-76916

Exploitation requires the attacker to hold a man-in-the-middle network position on the IEC 60870-5-104 TLS path used by ASE2000 V2 in Task Mode, and to present a certificate carrying multiple simultaneous faults that the client's flawed validation accepts. It applies only to versions 2.35 through 2.37 on Windows when the IEC-104 TLS client is actually used (Task Mode over TLS); deployments that do not use TLS-protected IEC-104, or where the test set runs on an isolated/trusted link with no interposition opportunity, are not realistically exploitable. Limiting factors: high attack complexity (MITM plus crafted multi-fault certificate), and the narrow, OT-specific deployment of the tool. No user interaction or authentication to the client is required (PR:N/UI:N).

The supplied CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N, base 9.1) describes an unauthenticated, network-reachable attack with high confidentiality and integrity impact but no availability impact - consistent with a MITM that reads and tampers with traffic but does not crash the endpoint. AC:H is well justified: the attacker must both achieve a man-in-the-middle position on the IEC-104 path and craft a certificate with the specific combination of simultaneous faults that slips past validation, which is not trivially automatable. No EPSS probability, KEV entry, POC, or SSVC decision data was provided, so there is no evidence of active or automatable exploitation; the score is driven by potential impact in an OT setting, not by demonstrated wide exploitation. Net assessment: a genuine integrity/confidentiality concern for the narrow population that runs this tool over TLS-protected IEC-104, but the MITM prerequisite and niche footprint make opportunistic mass exploitation unlikely - treat as targeted-risk, patch on normal OT maintenance cadence.

An attacker who can position themselves on the network path between the ASE2000 V2 test set and an IEC-104 server (for example on a shared substation LAN or a compromised network segment) presents a specially malformed certificate with multiple simultaneous faults. Because the TLS client accepts it instead of rejecting it, the attacker terminates the TLS session and relays traffic, reading and modifying telecontrol commands and responses in transit. No public POC is identified, and the high attack complexity reflects the need for both the MITM position and the crafted certificate.