Improper Certificate Validation in ZSIRep Client Library Affects Kamsoft Products

CVE-2026-113618

What is CVE-2026-113618?

The ZSIRep client library (ZSIREP.CLIENT.DLL) is compromised by improper server certificate validation. It employs a process-wide .NET callback that permits any certificate for HTTPS connections without the necessary validation checks. This vulnerability enables a man-in-the-middle attacker to masquerade as the ZSIRep server, potentially intercepting or altering authentication credentials and sensitive documents. The repercussions extend beyond the client session, as the callback remains active even after the client application is closed, jeopardizing the security of other HTTPS connections made within the same environment. Necessary updates have been released to rectify this issue.

References