Ase2000 V2
Monthly
TLS peer impersonation in Applied Systems Engineering's ASE2000 v2 (versions 2.35 through 2.37) lets a network-positioned attacker complete the TLS handshake as a fraudulent trusted peer because the client fails to properly validate the server certificate (CWE-295). Successful exploitation exposes and allows tampering with protected SCADA/RTU communications carried over the ostensibly secure channel. Reported through CISA ICS-CERT (ICSA-26-239-04); no public exploit identified at time of analysis and it is not listed in CISA KEV.
TLS peer impersonation in Applied Systems Engineering's ASE2000 v2 (versions 2.35 through 2.37) lets a network-positioned attacker complete the TLS handshake as a fraudulent trusted peer because the client fails to properly validate the server certificate (CWE-295). Successful exploitation exposes and allows tampering with protected SCADA/RTU communications carried over the ostensibly secure channel. Reported through CISA ICS-CERT (ICSA-26-239-04); no public exploit identified at time of analysis and it is not listed in CISA KEV.