Improper Certificate Validation in Nanosystems Supremo for Windows and macOS
CVE-2026-121624

7.6HIGH

Key Information:

Vendor

Nanosystems

Status
Supremo
Vendor
CVE Published:
3 November 2026

What is CVE-2026-121624?

Nanosystems Supremo for Windows and macOS versions prior to 5.0.2.3874 is vulnerable to improper certificate validation which could allow attackers on the same network to intercept and manipulate TLS connections. By using untrusted self-signed certificates, malicious actors can gain unauthorized access to sensitive information, including usernames, SHA-256 password hashes, and license codes. This vulnerability emphasizes the importance of ensuring robust certificate validation mechanisms to safeguard against man-in-the-middle attacks.

Affected Version(s)

Supremo 0 < 5.0.2.3874

References

https://pusi77.eu.org/blog/2026-11-03-supremo-tls-cve
technical-description
https://www.supremocontrol.com/changelog/
release-notes
https://www.supremocontrol.com/
product

CVSS V4

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Andrea Pusineri
.