CVE-2018-1285 is an XML external entity (XXE) vulnerability (CWE-611) in Apache log4net before 2.0.10 that lets an attacker who can supply a log4net configuration file trigger XXE-based attacks; on 2026-08-27 CISA republished it as part of ICS advisory ICSA-26-239-04 because Applied Systems Engineering's ASE2000 V2 Communications Test Set, a SCADA/RTU protocol test tool, bundles a vulnerable copy of log4net, alongside a companion TLS certificate-validation flaw in the product's own code.
Vulnerability summary
9.8
Critical
17.8%
EPSS score (FIRST)
No
CISA KEV catalog
2020-05-11
Published
Vulnerability ID: CVE-2018-1285 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| Applied Systems Engineering ASE2000 V2 Communications Test Set (bundled Apache log4net component) | — | ASE2000 versions 2.25 through 2.37 (per CISA advisory ICSA-26-239-04); fixed in 2.38, which upgrades the bundled log4net library to 3.3.1.0 |
What this means
CVE-2018-1285 is an Improper Restriction of XML External Entity Reference vulnerability (CWE-611) in Apache log4net. NVD's analysis (status "Modified") gives an NVD-confirmed Primary CVSS v3.1 base score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, describing the flaw generically: "Apache log4net versions before 2.0.10 do not disable XML external entities when parsing log4net configuration files. This allows for XXE-based attacks in applications that accept attacker-controlled log4net configuration files" (NVD).
Six-year-old logging-library bugs don't stay confined to the applications they were first found in: on 2026-08-27 CISA published ICS advisory ICSA-26-239-04 covering Applied Systems Engineering's ASE2000 V2 Communications Test Set, a tool SCADA technicians use to validate RTU/SCADA protocol communications (DNP3, IEC 60870-5-104, IEC 61850 and more), because versions 2.25 through 2.37 bundle a vulnerable copy of log4net. In that product-specific context, CISA's own CVSS recomputation reports v3.1 9.8 (matching NVD's generic score) and v4.0 9.2 (critical). The advisory covers the Chemical, Critical Manufacturing, Energy, and Water and Wastewater sectors with worldwide deployment, and researcher Enoch Wang is credited with reporting the issue (CISA ICS Advisory ICSA-26-239-04).
The same advisory bundles a companion CVE affecting the identical version range, CVE-2026-18717 (CWE-295 improper certificate validation in the ASE2000's own IEC 60870-5-104 TLS implementation, letting an attacker "impersonate the trusted peer, complete the TLS handshake, and read or modify protected communications"; NVD records only a Secondary CISA ICS-CERT rating of CVSS v3.1 7.4/v4.0 9.1, with no NVD Primary score as of 2026-10-31). CISA's advisory states that "all customers running ASE2000 versions 2.25 through 2.37 are affected by this issue and are required to upgrade to version 2.38 or later," which fixes both issues by upgrading the bundled log4net library to 3.3.1.0 and correcting the TLS certificate-validation logic (CISA ICS Advisory ICSA-26-239-04, NVD).
Applied Systems Engineering (which does business as ASE/Kalkitech) confirms the issue on its own site: the company's cyber-security page lists a "Security Advisory – ASE2000 V2 - Apache log4net (CVE-2018-1285) and IEC 60870-5-104 TLS Improper Certificate Validation" document, though the full advisory text requires a customer login to download (Applied Systems Engineering).
As of 2026-10-31, FIRST scores the probability of exploitation at 0.17823 for CVE-2018-1285 (97.17th percentile — a moderate raw score but a high percentile ranking, reflecting log4net's broad installed base) and 0.00272 (19.7th percentile) for the newer, product-specific companion CVE-2026-18717; neither CVE is present in the CISA Known Exploited Vulnerabilities catalog as of 2026-10-30 (catalog version 2026.10.30, 1,766 entries, checked by exact cveID match against the raw live KEV feed) (FIRST EPSS, CISA KEV).
Utilities and technicians running ASE2000 V2 between 2.25 and 2.37 should upgrade to 2.38 or later to close both the log4net XXE path and the TLS certificate-validation gap in the same release; where an immediate upgrade is not possible, CISA's standard guidance applies: keep the test set off the internet and restrict who can supply its log4net configuration files or intercept its IEC 60870-5-104 TLS sessions.
Evidence
- Apache log4net before 2.0.10 does not disable XML external entities when parsing configuration files, allowing XXE-based attacks (CWE-611); NVD Primary CVSS v3.1 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, status Modified. — NVD
- Republished on 2026-08-27 as ICSA-26-239-04 because Applied Systems Engineering's ASE2000 V2 Communications Test Set versions 2.25-2.37 bundle vulnerable log4net; covers Chemical, Critical Manufacturing, Energy, and Water and Wastewater sectors worldwide; reported by Enoch Wang; CISA's own recomputation is CVSS v3.1 9.8/v4.0 9.2. — CISA ICS Advisory ICSA-26-239-04
- Companion CVE-2026-18717 (improper TLS certificate validation in ASE2000's IEC 60870-5-104 implementation) affects the same 2.25-2.37 range; NVD records only a Secondary CISA ICS-CERT CVSS v3.1 7.4/v4.0 9.1, no NVD Primary score as of 2026-10-31; both issues fixed in ASE2000 2.38. — NVD
- Applied Systems Engineering (ASE/Kalkitech) lists a "Security Advisory – ASE2000 V2 - Apache log4net (CVE-2018-1285) and IEC 60870-5-104 TLS Improper Certificate Validation" document on its cyber-security page, confirming the two bundled CVEs. — Applied Systems Engineering
- EPSS score is 0.17823 (97.17th percentile) for CVE-2018-1285 as of 2026-10-31; not present in the CISA KEV catalog as of 2026-10-30 (catalog version 2026.10.30, 1,766 entries). — FIRST EPSS
