Description

ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on Windows contains an improper certificate validation vulnerability in the IEC 60870-5-104 TLS client (Task Mode). This allows a network-positioned attacker to bypass certificate validation via a certificate with multiple simultaneous faults, enabling a Man-in-the-Middle attack on protected communications.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-09-12T23:17:01.490Z",
  "pubdate": "2026-09-12T23:17:01.490Z",
  "executiveSummary": "The ASE2000 V2 Communication Test Set (versions 2.35 through 2.37) on Windows exhibits a critical vulnerability in its IEC 60870-5-104 TLS client implementation. The vulnerability stems from improper validation of X.509 certificates, specifically failing to handle complex or malformed certificates that present multiple simultaneous validation errors.\nThis flaw enables a network-positioned attacker to intercept, inspect, or modify sensitive industrial control system (ICS) communications by bypassing TLS certificate verification. By presenting a crafted certificate, an adversary can successfully conduct a Man-in-the-Middle (MitM) attack, effectively breaking the cryptographic security of the TLS tunnel.\nThe risk is significant for utility and industrial environments relying on the ASE2000 for protocol testing and traffic monitoring. Successful exploitation does not require prior authentication or elevated privileges, provided the attacker can position themselves between the communication endpoints. Given the nature of the IEC 60870-5-104 protocol, this could lead to unauthorized command injection, data manipulation, or the compromise of sensitive operational technology (OT) parameters.",
  "technicalDetails": "The vulnerability resides within the IEC 60870-5-104 TLS client 'Task Mode' component of the ASE2000 V2 software. The application logic responsible for processing the X.509 certificate chain and verifying the authenticity of the remote server fails to implement a robust state machine for error handling during the certificate verification process.\nThe root cause is an improper validation logic flaw where the verification process can be bypassed if the provided certificate contains multiple concurrent defects. Rather than failing securely when one or more policy checks (e.g., signature verification, expiration check, or chain-of-trust validation) fail, the software fails to correctly aggregate these fault states, leading to a permissive outcome where the connection is established despite an invalid or forged certificate.\nAn attack flow typically involves an adversary positioned on the local area network or segment through which the IEC 60870-5-104 traffic flows. The attacker utilizes standard ARP poisoning or DNS spoofing techniques to redirect traffic intended for the legitimate server through their own controlled proxy machine. When the ASE2000 client initiates the TLS handshake, the attacker presents a malicious certificate that triggers the logic flaw by including a specific combination of faults designed to bypass the validation routines.\nUpon successful handshake completion, the ASE2000 client incorrectly establishes the encrypted session with the attacker’s machine, believing it to be the trusted server. Because the TLS tunnel is terminated by the attacker, the confidentiality and integrity of the IEC 60870-5-104 traffic are fully compromised. The attacker can then inject arbitrary commands into the industrial control stream, modify telemetry data, or perform reconnaissance on the network assets to identify further vulnerabilities.\nThis vulnerability is particularly dangerous because the client lacks the resilience to enforce cryptographic integrity under adversarial network conditions. The flaw is inherent in the way the client library handles certificate attributes during the negotiation phase. No specific authentication is required from the attacker, and the exploit is transparent to the user, as the application reports a successful connection. The impact extends to the entire session life-cycle, allowing for prolonged unauthorized access to critical OT management functions."
}