CISA Advisory: Critical Vulnerabilities in Applied Systems Engineering ASE2000 V2 Communications Test Set

CISA released an Industrial Control Systems advisory on August 27, 2026, detailing two vulnerabilities affecting the Applied Systems Engineering ASE2000 V2 Communications Test Set, versions 2.25 through 2.37. The first vulnerability, CVE-2018-1285, is an improper restriction of XML external entity reference (XXE) in the bundled Apache log4net library, allowing an attacker to read or write arbitrary local files or cause outbound network requests. The second, CVE-2026-18717, is an improper certificate validation vulnerability in the IEC 60870-5-104 TLS client, allowing an attacker to impersonate a trusted peer, complete the TLS handshake, and read or modify protected communications. The CVSS scores range from 7.4 to 9.8 (critical). The vendor, ASE/Kalkitech, has released version 2.38 which upgrades log4net and corrects certificate validation. CISA recommends upgrading immediately and provides interim mitigations such as restricting write access, isolating networks, and using firewalls. No known public exploitation has been reported.