Applied Systems Engineering ASE2000 V2 Communications Test Set

Applied Systems Engineering’s ASE2000 V2 Communications Test Set versions 2.25 through 2.37 are vulnerable to two separate attacks. The first stems from an improper XML External Entity Reference (CWE-611) due to a Log4Net vulnerability, allowing attackers to read or write arbitrary files and intercept network communications. The second vulnerability (CWE-295) relates to improper certificate validation, potentially enabling impersonation and modification of protected communications. Both vulnerabilities are being addressed with version 2.38, which includes Log4Net and IEC 60870-5-104 fixes. Immediate action is advised: upgrade to 2.38, restrict write access to the ASE2000 installation directory, and avoid using IEC 60870-5-104 over untrusted networks.