CVE-2026-90647: ASE2000 V2 Auth Bypass Vulnerability

CVE-2026-90647 Overview

CVE-2026-90647 is an improper certificate validation vulnerability [CWE-295] in the ASE/Kalkitech ASE2000 V2 Communication Test Set. The flaw affects versions 2.35 through 2.37 on Windows and resides in the IEC 60870-5-104 Transport Layer Security (TLS) client running in Task Mode. A network-positioned attacker can present a certificate containing multiple simultaneous faults to bypass validation. Successful exploitation enables a Man-in-the-Middle (MITM) attack against protected industrial control system communications used in electric power and utility environments.

Critical Impact
Attackers can intercept, read, and modify IEC 60870-5-104 telecontrol traffic between the ASE2000 test set and substation equipment, undermining the confidentiality and integrity of operational technology communications.

Affected Products

ASE/Kalkitech ASE2000 V2 Communication Test Set version 2.35 on Windows
ASE/Kalkitech ASE2000 V2 Communication Test Set version 2.36 on Windows
ASE/Kalkitech ASE2000 V2 Communication Test Set version 2.37 on Windows

Discovery Timeline

2026-09-12 - CVE-2026-90647 published to the National Vulnerability Database
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90647

Vulnerability Analysis

The ASE2000 V2 Communication Test Set is used by utility engineers to validate substation automation protocols, including IEC 60870-5-104. When operating in Task Mode as a TLS client, the application performs certificate validation on the peer presented by the remote IEC 104 server. The validation routine fails to correctly reject certificates that contain multiple simultaneous defects. An attacker on the network path can craft a certificate that trips more than one validation condition and slip past the client's checks. Once the TLS handshake completes with an attacker-controlled certificate, the client trusts a session it should have terminated.

Root Cause

The root cause is improper handling of compound certificate validation failures in the IEC 60870-5-104 TLS client. Rather than treating any single defect as a terminal error, the validation logic mishandles certificates presenting several faults at once, allowing the chain-of-trust decision to short-circuit. This aligns with [CWE-295: Improper Certificate Validation]. See the ASE Systems Security Advisory for vendor-supplied technical detail.

Attack Vector

Exploitation requires network-adjacent positioning between the ASE2000 client and the intended IEC 60870-5-104 server. The attacker intercepts the connection, presents a specially crafted certificate with multiple simultaneous faults, and completes the TLS handshake. After the handshake, the attacker relays traffic to the legitimate endpoint while observing and modifying IEC 104 telecontrol messages. This exposes commands, measurements, and control signals in a supervisory control and data acquisition (SCADA) context.

No verified exploit code is publicly available. Refer to the vendor advisory for protocol-level technical details.

Detection Methods for CVE-2026-90647

Indicators of Compromise

Unexpected TLS handshake completions on IEC 60870-5-104 sessions (TCP/2404) using certificates that do not chain to the approved substation certificate authority.
Presence of ASE2000 V2 versions 2.35, 2.36, or 2.37 on engineering workstations connecting to operational technology networks.
Duplicate or mismatched TLS session identifiers between the ASE2000 host and expected substation endpoints, indicating relayed traffic.

Detection Strategies

Inspect packet captures from engineering VLANs for IEC 104 sessions on TCP/2404 and verify the server certificate against the trusted issuer.
Correlate process execution telemetry for ASE2000.exe on Windows engineering hosts with outbound TLS connections to substation gateways.
Alert on TLS sessions where the presented certificate fails multiple validation checks (expired plus untrusted issuer plus hostname mismatch) but the connection still proceeds.

Monitoring Recommendations

Enable full packet capture on the interface between engineering workstations and substation IEC 104 servers for forensic review.
Log and centrally aggregate Windows application events from ASE2000 hosts to identify version, invocation, and remote endpoint details.
Deploy passive network monitoring in the OT network to baseline expected IEC 104 endpoints and flag deviations in certificate chains.

How to Mitigate CVE-2026-90647

Immediate Actions Required

Inventory all Windows hosts running ASE2000 V2 versions 2.35 through 2.37 and restrict their network reach to trusted substation endpoints.
Isolate engineering laptops on a dedicated VLAN with strict egress controls when performing IEC 60870-5-104 testing.
Contact ASE/Kalkitech for a fixed release and apply upgrades once available.

Patch Information

The vendor has published a security advisory tracking this issue. Consult the ASE Systems Security Advisory for the fixed version and upgrade guidance. Apply the vendor-supplied update to any ASE2000 V2 installation in the affected version range.

Workarounds

Perform IEC 60870-5-104 TLS testing only over point-to-point links or air-gapped test benches where an attacker cannot occupy the network path.
Restrict outbound TCP/2404 from ASE2000 hosts using host-based firewall rules that whitelist only known substation gateway IP addresses.
Use a jump host or bastion with strict certificate pinning between the ASE2000 workstation and the target device where feasible.
Rotate any credentials or configuration data that traversed potentially exposed IEC 104 sessions during the exposure window.

bash

# Example Windows Defender Firewall rule restricting ASE2000 IEC 104 egress
New-NetFirewallRule -DisplayName "ASE2000 IEC104 Allowlist" `
  -Direction Outbound `
  -Program "C:\Program Files\ASE\ASE2000\ASE2000.exe" `
  -Protocol TCP `
  -RemotePort 2404 `
  -RemoteAddress 10.20.30.40,10.20.30.41 `
  -Action Allow

New-NetFirewallRule -DisplayName "ASE2000 IEC104 Block Default" `
  -Direction Outbound `
  -Program "C:\Program Files\ASE\ASE2000\ASE2000.exe" `
  -Protocol TCP `
  -RemotePort 2404 `
  -Action Block