CVE-2018-1285
CVSS 9.8 CRITICAL: apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. EPSS 18% (97th percentile).
Vulnerabilities · 47 days ago
CISA warned that Applied Systems Engineering’s ASE2000 V2 Communications Test Set has two vulnerabilities affecting versions 2.25 through 2.37, with the fixed release at 2.38. The advisory says the product is deployed worldwide across critical infrastructure, including energy.
The first flaw is an XML external entity issue in bundled log4net code: crafted configuration files can make the software read local files or reach out to outside systems. The second flaw is in TLS certificate handling for IEC 60870-5-104, where bad validation can let an attacker impersonate the trusted peer and read or alter protected communications.
For OT and ICS environments, the exposure is bigger than one workstation because this test set may sit in validation workflows that decide whether communications are trusted. Where ASE2000 V2 is part of those checks, the risk is not just file access but a break in the trust layer that protects operational traffic.
CVSS 9.8 CRITICAL: apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. EPSS 18% (97th percentile).
CVSS 7.4 HIGH: aSE2000 2.35 through 2.37 is vulnerable to an improper certificate validation vulnerability, which may allow an…
1 source covering this story
Applied Systems Engineering ASE2000 V2 Communications Test Set | CISA
Applied Systems Engineering ASE2000 V2 Communications Test Set Summary Successful exploitation of these vulnerabilities could allow an attacker to read or write arbitrary local files, cause the application to issue outbound network requests, or intercept the connection to…
Part of the PlainSec briefing for 2026-08-28