Improper Certificate Validation in ASE2000 by ASE Systems
CVE-2026-18717
9.1CRITICAL
What is CVE-2026-18717?
The ASE2000 product versions 2.35 to 2.37 from ASE Systems contain a vulnerability that allows improper validation of SSL/TLS certificates. This security flaw enables an attacker to pose as a legitimate trusted peer within the network, successfully completing the TLS handshake process. Consequently, this could result in unauthorized access to sensitive information, allowing attackers to read or even modify protected communication between parties.
Affected Version(s)
ASE2000 V2 2.25 <= 2.37
ASE2000 V2 2.38
References
CVSS V4
Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Enoch Wang reported this vulnerability to CISA.