THE CISA advisory ICSA-26-239-04 warns about vulnerabilities in the Applied Systems Engineering (ASE) ASE2000 V2 Communications Test Set versions 2.25 to 2.37, impacting critical infrastructure sectors such as Chemical, Energy, and Water. Key vulnerabilities include improper XML external entity reference and improper certificate validation, potentially allowing attackers to exploit file access, impersonate trusted peers, or intercept communications.
An upgraded version 2.38 addresses these issues, and users are urged to upgrade immediately. Interim mitigation measures include restricting file access and ensuring system protection via firewalls.