Search
Find a vulnerability
Search criteria
2 vulnerabilities by Nanosystems
CVE-2026-121624 (GCVE-0-2026-121624)
Vulnerability from nvd – Published: 2026-11-03 17:13 – Updated: 2026-11-03 22:41
VLAI
EPSS
VEX
Title
Nanosystems Supremo before 5.0.2.3874 Improper TLS Certificate Validation
Summary
Nanosystems Supremo for Windows and macOS before 5.0.2.3874 contains an improper certificate validation vulnerability that allows adjacent attackers to intercept TLS connections by presenting untrusted certificates. Attackers on the same network can terminate and relay the client's TLS session using self-signed certificates to read usernames, SHA-256 password hashes, and license codes.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 22:36 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://pusi77.eu.org/blog/2026-11-03-supremo-tls-cve | technical-description |
| https://www.supremocontrol.com/changelog/ | release-notes |
| https://www.supremocontrol.com/ | product |
| https://www.vulncheck.com/advisories/nanosystems-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Nanosystems | Supremo |
Affected:
0 , < 5.0.2.3874
(custom)
|
Date Public
2026-11-03 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121624",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T22:36:34.514075Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T22:41:14.021Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Supremo",
"vendor": "Nanosystems",
"versions": [
{
"lessThan": "5.0.2.3874",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrea Pusineri"
}
],
"datePublic": "2026-11-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Nanosystems Supremo for Windows and macOS before 5.0.2.3874 contains an improper certificate validation vulnerability that allows adjacent attackers to intercept TLS connections by presenting untrusted certificates. Attackers on the same network can terminate and relay the client\u0027s TLS session using self-signed certificates to read usernames, SHA-256 password hashes, and license codes."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T17:13:52.053Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://pusi77.eu.org/blog/2026-11-03-supremo-tls-cve"
},
{
"tags": [
"release-notes"
],
"url": "https://www.supremocontrol.com/changelog/"
},
{
"tags": [
"product"
],
"url": "https://www.supremocontrol.com/"
},
{
"name": "VulnCheck Advisory: Nanosystems Supremo before 5.0.2.3874 Improper TLS Certificate Validation",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nanosystems-supremo-before-5.0.2.3874-improper-tls-certificate-validation"
}
],
"title": "Nanosystems Supremo before 5.0.2.3874 Improper TLS Certificate Validation",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121624",
"datePublished": "2026-11-03T17:13:52.053Z",
"dateReserved": "2026-11-03T16:57:36.800Z",
"dateUpdated": "2026-11-03T22:41:14.021Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121624 (GCVE-0-2026-121624)
Vulnerability from cvelistv5 – Published: 2026-11-03 17:13 – Updated: 2026-11-03 22:41
VLAI
EPSS
VEX
Title
Nanosystems Supremo before 5.0.2.3874 Improper TLS Certificate Validation
Summary
Nanosystems Supremo for Windows and macOS before 5.0.2.3874 contains an improper certificate validation vulnerability that allows adjacent attackers to intercept TLS connections by presenting untrusted certificates. Attackers on the same network can terminate and relay the client's TLS session using self-signed certificates to read usernames, SHA-256 password hashes, and license codes.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-03 22:36 UTC
CWE
- CWE-295 - Improper Certificate Validation
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://pusi77.eu.org/blog/2026-11-03-supremo-tls-cve | technical-description |
| https://www.supremocontrol.com/changelog/ | release-notes |
| https://www.supremocontrol.com/ | product |
| https://www.vulncheck.com/advisories/nanosystems-… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Nanosystems | Supremo |
Affected:
0 , < 5.0.2.3874
(custom)
|
Date Public
2026-11-03 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121624",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-03T22:36:34.514075Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T22:41:14.021Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Supremo",
"vendor": "Nanosystems",
"versions": [
{
"lessThan": "5.0.2.3874",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Andrea Pusineri"
}
],
"datePublic": "2026-11-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Nanosystems Supremo for Windows and macOS before 5.0.2.3874 contains an improper certificate validation vulnerability that allows adjacent attackers to intercept TLS connections by presenting untrusted certificates. Attackers on the same network can terminate and relay the client\u0027s TLS session using self-signed certificates to read usernames, SHA-256 password hashes, and license codes."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "ADJACENT",
"baseScore": 7.6,
"baseSeverity": "HIGH",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "ADJACENT_NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-295",
"description": "Improper Certificate Validation",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-03T17:13:52.053Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"tags": [
"technical-description"
],
"url": "https://pusi77.eu.org/blog/2026-11-03-supremo-tls-cve"
},
{
"tags": [
"release-notes"
],
"url": "https://www.supremocontrol.com/changelog/"
},
{
"tags": [
"product"
],
"url": "https://www.supremocontrol.com/"
},
{
"name": "VulnCheck Advisory: Nanosystems Supremo before 5.0.2.3874 Improper TLS Certificate Validation",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/nanosystems-supremo-before-5.0.2.3874-improper-tls-certificate-validation"
}
],
"title": "Nanosystems Supremo before 5.0.2.3874 Improper TLS Certificate Validation",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-121624",
"datePublished": "2026-11-03T17:13:52.053Z",
"dateReserved": "2026-11-03T16:57:36.800Z",
"dateUpdated": "2026-11-03T22:41:14.021Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}