CISA 2026-08-27

Applied Systems Engineering ASE2000 V2 Communications Test Set

Machine-generated analysis · WAYSCloud LLM

ASE2000 V2 Communications Test Set versions 2.25-2.37 are vulnerable to XML external entity attacks and improper TLS certificate validation. The vendor recommends upgrading to version 2.38.

Context

The advisory identifies the Applied Systems Engineering ASE2000 V2 Communications Test Set as the affected product. It states that versions 2.25 through 2.37 contain an XXE flaw in the bundled log4net library and a certificate validation issue that could allow file access, outbound network requests, or TLS impersonation. The advisory notes deployment in critical infrastructure sectors such as chemical, energy, and water worldwide. The vendor’s mitigation is to upgrade to version 2.38, which updates log4net to 3.3.1.0 and corrects certificate validation logic.

Operator considerations

Check: Verify the ASE2000 V2 version is not between 2.25 and 2.37.
Isolate: Limit network communication of affected ASE2000 units until patched.
Patch: Upgrade ASE2000 V2 to version 2.38 as provided by the vendor.
Log: Monitor for unexpected outbound network requests or TLS handshake anomalies from the device.

From Cybersecurity and Infrastructure Security Agency ↗

Successful exploitation of these vulnerabilities could allow an attacker to read or write arbitrary local files, cause the application to issue outbound network requests, or intercept the connection to impersonate the trusted peer, complete the TLS handshake, and read or modify the protected communications.

The following versions of Applied Systems Engineering ASE2000 V2 Communications Test Set are affected:

ASE2000 >=2.25|=2.25|

Read the full advisory on CISA →