Find a vulnerability

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

1 vulnerability by Nanosystems

CVE-2026-121624 (GCVE-0-2026-121624)

Vulnerability from cvelistv5 – Published: 2026-11-03 17:13 – Updated: 2026-11-03 22:41

Title

Nanosystems Supremo before 5.0.2.3874 Improper TLS Certificate Validation

Summary

Nanosystems Supremo for Windows and macOS before 5.0.2.3874 contains an improper certificate validation vulnerability that allows adjacent attackers to intercept TLS connections by presenting untrusted certificates. Attackers on the same network can terminate and relay the client's TLS session using self-signed certificates to read usernames, SHA-256 password hashes, and license codes.

Severity

7.6 (High)


                        
                          CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

6.8 (Medium)


                        
                          CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-03 22:36 UTC

CWE

CWE-295 - Improper Certificate Validation

Assigner

VulnCheck CNA

References

4 references

URL	Tags
https://pusi77.eu.org/blog/2026-11-03-supremo-tls-cve	technical-description
https://www.supremocontrol.com/changelog/	release-notes
https://www.supremocontrol.com/	product
https://www.vulncheck.com/advisories/nanosystems-…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
Nanosystems	Supremo	Affected: 0 , < 5.0.2.3874 (custom)

Date Public

2026-11-03 00:00

Credits

Andrea Pusineri

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-121624",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-03T22:36:34.514075Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T22:41:14.021Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Supremo",
          "vendor": "Nanosystems",
          "versions": [
            {
              "lessThan": "5.0.2.3874",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Andrea Pusineri"
        }
      ],
      "datePublic": "2026-11-03T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Nanosystems Supremo for Windows and macOS before 5.0.2.3874 contains an improper certificate validation vulnerability that allows adjacent attackers to intercept TLS connections by presenting untrusted certificates. Attackers on the same network can terminate and relay the client\u0027s TLS session using self-signed certificates to read usernames, SHA-256 password hashes, and license codes."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "ADJACENT",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "ADJACENT_NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-295",
              "description": "Improper Certificate Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-03T17:13:52.053Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://pusi77.eu.org/blog/2026-11-03-supremo-tls-cve"
        },
        {
          "tags": [
            "release-notes"
          ],
          "url": "https://www.supremocontrol.com/changelog/"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://www.supremocontrol.com/"
        },
        {
          "name": "VulnCheck Advisory: Nanosystems Supremo before 5.0.2.3874 Improper TLS Certificate Validation",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/nanosystems-supremo-before-5.0.2.3874-improper-tls-certificate-validation"
        }
      ],
      "title": "Nanosystems Supremo before 5.0.2.3874 Improper TLS Certificate Validation",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-121624",
    "datePublished": "2026-11-03T17:13:52.053Z",
    "dateReserved": "2026-11-03T16:57:36.800Z",
    "dateUpdated": "2026-11-03T22:41:14.021Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}