Kalkitech ASE2000 SCADA Test Set Ships Broken TLS Certificate Checks

Executive Summary

CISA has published an ICS advisory for a high-severity improper certificate validation flaw (CVE-2026-90647) in ASE/Kalkitech's ASE2000 V2 Communication Test Set, a Windows tool used to test and validate IEC 60870-5-104 communications — a protocol widely deployed for substation and grid telemetry (RTUs, control centers). The bug sits in the product's TLS client for that protocol (Task Mode): a certificate presenting multiple simultaneous validation faults can slip past the validation logic entirely, letting a network-positioned attacker impersonate a trusted peer.

CVSS Score: 7.4 (CVSS 3.1, as scored in the originating advisory) / 9.1 (CVSS 4.0)

A fixed version — 2.38 — is available from the vendor.

Vulnerability Overview

Affected Versions

The same 2.38 release also bumps a bundled log4net dependency to 3.3.1.0, addressing a separate XXE issue tracked under a different CVE in the same CISA advisory.

Attack Vector

1. Attacker positions themselves to intercept or relay TLS traffic between
   the ASE2000 test set and its IEC 60870-5-104 peer (e.g. on a shared
   substation network segment)
2. Attacker presents a certificate engineered with multiple simultaneous
   validation defects (e.g. chained trust and name-mismatch faults together)
3. The ASE2000's TLS client, running in Task Mode, fails to properly
   reject the malformed certificate
4. The TLS handshake completes with the attacker positioned as a
   trusted man-in-the-middle
5. Attacker can read and potentially alter grid telemetry / control
   traffic flowing through the test session

Impact of Successful Exploitation

This aligns with MITRE ATT&CK for ICS T0830 (Man in the Middle), given the certificate-bypass mechanism used to establish the intercepting position.

Test tools carry real risk in OT environments. The ASE2000 is used to validate live substation communications, so a broken TLS client in the tool itself can undermine the very security property (certificate trust) it's meant to help engineers verify.

Immediate Remediation

Step 1: Check Your Version

Confirm your ASE2000 V2 Communication Test Set build falls in the 2.35–2.37 range.

Step 2: Reduce Exposure

1. Upgrade to version 2.38 as soon as operationally feasible
2. Restrict TLS port 2404 access via firewall/ACL to only trusted engineering and control-center hosts
3. Enable mutual TLS authentication where supported, so both ends must present valid certificates rather than relying on one-sided validation
4. Isolate ICS test tooling on a segmented network separate from general IT traffic

Step 3: Monitor for Abuse

# Watch for unexpected certificate chains or repeated TLS handshake
# anomalies on IEC 60870-5-104 sessions (port 2404)
 
# Flag any new or unrecognized hosts participating in
# substation/RTU TLS sessions

Post-Remediation Steps

1. Apply the vendor patch (2.38) across all deployed ASE2000 test-set installations
2. Review historical session logs, where available, for anomalous certificate presentations during the affected window
3. Re-validate trust configurations on all IEC 60870-5-104 TLS endpoints following the upgrade
4. Coordinate with CISA's ICS-CERT advisory (ICSA-26-239-04) for sector-specific guidance and the companion log4net XXE fix

References

• CISA ICS Advisory ICSA-26-239-04
• NIST NVD — CVE-2026-90647
• OffSeq Threat Radar — CVE-2026-90647
• VulDB — CVE-2026-90647