Vulnerability · Published Sep 12, 2026 · Assigned by mitre

CVE-2026-90647

High 7.4

In plain English

A high-severity improper certificate validation in ASE2000 V2 Communication Test Set from Kalkitech. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)0.2%top 88.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

ASE/Kalkitech ASE2000 V2 Communication Test Set 2.35 through 2.37 on Windows contains an improper certificate validation vulnerability in the IEC 60870-5-104 TLS client (Task Mode). This allows a network-positioned attacker to bypass certificate validation via a certificate with multiple simultaneous faults, enabling a Man-in-the-Middle attack on protected communications.

Affected products (as reported)

Vendor	Product	Versions
Kalkitech	ASE2000 V2 Communication Test Set	2.35 – before 2.38

Weakness: CWE-295 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

https://www.ase-systems.com/wp-content/uploads/2026/07/CYB_2026_86278_Advisory_v1.0.pdf vendor-advisory