{"id":"CVE-2026-113618","kind":"vulnerability","aliases":["CVE-2026-113618"],"related":[],"title":"ZSIRep .NET client: accepts any HTTPS certificate, enabling man-in-the-middle interception","description":"The ZSIRep client library (ZSIREP.CLIENT.DLL) is vulnerable to improper server certificate validation. It registers a process-wide .NET callback that accepts any certificate for HTTPS connections without verification. This allows a man-in-the-middle attacker to impersonate the ZSIRep server and intercept or modify authentication data and documents. The callback persists after the client is closed, weakening other HTTPS connections in the same application.\n\n\nThe issue was fixed in version 2.12.3.1. The library is used in KS-SOMED (fixed in 2026.03.0.01), KS-PPS (fixed in 2026.03.1.0), KS-MEDIS (fixed in 2026.03.0.0), KS-SOLAB (fixed in 2026.3.1.0), and KS-ASW (fixed in 2026.3.0.1).","summary":"The ZSIRep client library for .NET registers a process-wide callback that accepts any server certificate without checking it. An attacker on the network path can impersonate the ZSIRep server and read or change authentication data and documents, and the callback also weakens other HTTPS connections in the same application.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dotnet","ks-asw","ks-medis","ks-pps","ks-solab","ks-somed","package","zsirep"],"not_affected_if":["library-version-2.12.3.1-or-later","no-zsirep-client-use"],"how_to_check":"- Check whether the application references ZSIREP.CLIENT.DLL and which version it ships with.\n- Check the KS-SOMED, KS-PPS, KS-MEDIS, KS-SOLAB or KS-ASW installed version against the fixed releases.","fix":"- ZSIRep client library: `2.12.3.1`\n- KS-SOMED: `2026.03.0.01`\n- KS-PPS: `2026.03.1.0`\n- KS-MEDIS: `2026.03.0.0`\n- KS-SOLAB: `2026.3.1.0`\n- KS-ASW: `2026.3.0.1`","status":"open","published_at":"2026-11-06T15:17:08+00:00","first_seen_at":"2026-11-06T15:42:43+00:00","triaged_at":"2026-11-06T15:44:38+00:00","updated_at":"2026-11-06T15:44:38+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T15:44:38Z","model":"claude-haiku-5-5","output":{"fix":"- ZSIRep client library: `2.12.3.1`\n- KS-SOMED: `2026.03.0.01`\n- KS-PPS: `2026.03.1.0`\n- KS-MEDIS: `2026.03.0.0`\n- KS-SOLAB: `2026.3.1.0`\n- KS-ASW: `2026.3.0.1`","reach":"network","title":"ZSIRep .NET client: accepts any HTTPS certificate, enabling man-in-the-middle interception","impact":"high","summary":"The ZSIRep client library for .NET registers a process-wide callback that accepts any server certificate without checking it. An attacker on the network path can impersonate the ZSIRep server and read or change authentication data and documents, and the callback also weakens other HTTPS connections in the same application.","audience":"businesses","category":"package","nicknames":[],"who_cares":["dotnet","zsirep","ks-somed","ks-pps","ks-medis","ks-solab","ks-asw"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker reads and alters authentication data and documents in transit","analyst_note":"","how_to_check":"- Check whether the application references ZSIREP.CLIENT.DLL and which version it ships with.\n- Check the KS-SOMED, KS-PPS, KS-MEDIS, KS-SOLAB or KS-ASW installed version against the fixed releases.","plain_action":"","needs_analyst":false,"not_affected_if":["library-version-2.12.3.1-or-later","no-zsirep-client-use"],"who_is_affected":"Any application that uses the ZSIRep client library is exposed, and the flaw applies to the process as a whole, not just the ZSIRep calls. The sources name KS-SOMED, KS-PPS, KS-MEDIS, KS-SOLAB and KS-ASW as products that use the library. Exposure needs a man-in-the-middle position between the client and the ZSIRep server, so systems on a trusted network path are the main concern.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000815,"input_tokens":4412,"output_tokens":748,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113618':17A,20A '-2026':16A,19A '2.12.3.1':163C '2026.03.0.0':186C '2026.03.0.01':174C '2026.03.1.0':180C '2026.3.0.1':199C '2026.3.1.0':192C 'accept':4A,52B,111C 'allow':120C 'also':81B 'applic':89B,156C 'asw':24B,196C 'attack':60B,127C 'authent':74B,137C 'callback':50B,80B,109C,142C 'certif':7A,55B,100C,113C 'chang':73B 'check':57B 'client':3A,41B,92C,146C 'close':148C 'connect':85B,116C,152C 'cve':15A,18A 'data':75B,138C 'document':77B,140C 'dotnet':21B 'enabl':8A 'fix':160C,172C,178C,184C,190C,197C 'https':6A,84B,115C,151C 'imperson':66B,129C 'improp':98C 'intercept':14A,134C 'issu':158C 'ks':23B,26B,29B,32B,35B,170C,176C,182C,188C,195C 'ks-asw':22B,194C 'ks-medi':25B,181C 'ks-pps':28B,175C 'ks-solab':31B,187C 'ks-some':34B,169C 'librari':42B,93C,165C 'man':10A,123C 'man-in-the-middl':9A,122C 'medi':27B,183C 'middl':13A,126C 'modifi':136C 'net':2A,44B,108C 'network':63B 'packag':37B 'path':64B 'persist':143C 'pps':30B,177C 'process':48B,106C 'process-wid':47B,105C 'read':71B 'regist':45B,103C 'server':54B,69B,99C,132C 'solab':33B,189C 'some':36B,171C 'use':167C 'valid':101C 'verif':118C 'version':162C 'vulner':96C 'weaken':82B,149C 'wide':49B,107C 'without':56B,117C 'zsirep':1A,38B,40B,68B,91C,131C 'zsirep.client.dll':94C","nicknames":[],"mitigations":[],"who_affected":"Any application that uses the ZSIRep client library is exposed, and the flaw applies to the process as a whole, not just the ZSIRep calls. The sources name KS-SOMED, KS-PPS, KS-MEDIS, KS-SOLAB and KS-ASW as products that use the library. Exposure needs a man-in-the-middle position between the client and the ZSIRep server, so systems on a trusted network path are the main concern.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dotnet","ksasw","ksmedis","kspps","kssolab","kssomed","medium","package","zsirep"],"campaign_type":null,"search_a":"'-113618':17A,20A '-2026':16A,19A 'accept':4A 'certif':7A 'client':3A 'cve':15A,18A 'enabl':8A 'https':6A 'intercept':14A 'man':10A 'man-in-the-middl':9A 'middl':13A 'net':2A 'zsirep':1A","search_b":"'accept':52B 'also':81B 'applic':89B 'asw':24B 'attack':60B 'authent':74B 'callback':50B,80B 'certif':55B 'chang':73B 'check':57B 'client':41B 'connect':85B 'data':75B 'document':77B 'dotnet':21B 'https':84B 'imperson':66B 'ks':23B,26B,29B,32B,35B 'ks-asw':22B 'ks-medi':25B 'ks-pps':28B 'ks-solab':31B 'ks-some':34B 'librari':42B 'medi':27B 'net':44B 'network':63B 'packag':37B 'path':64B 'pps':30B 'process':48B 'process-wid':47B 'read':71B 'regist':45B 'server':54B,69B 'solab':33B 'some':36B 'weaken':82B 'wide':49B 'without':56B 'zsirep':38B,40B,68B","search_c":"'2.12.3.1':163C '2026.03.0.0':186C '2026.03.0.01':174C '2026.03.1.0':180C '2026.3.0.1':199C '2026.3.1.0':192C 'accept':111C 'allow':120C 'applic':156C 'asw':196C 'attack':127C 'authent':137C 'callback':109C,142C 'certif':100C,113C 'client':92C,146C 'close':148C 'connect':116C,152C 'data':138C 'document':140C 'fix':160C,172C,178C,184C,190C,197C 'https':115C,151C 'imperson':129C 'improp':98C 'intercept':134C 'issu':158C 'ks':170C,176C,182C,188C,195C 'ks-asw':194C 'ks-medi':181C 'ks-pps':175C 'ks-solab':187C 'ks-some':169C 'librari':93C,165C 'man':123C 'man-in-the-middl':122C 'medi':183C 'middl':126C 'modifi':136C 'net':108C 'persist':143C 'pps':177C 'process':106C 'process-wid':105C 'regist':103C 'server':99C,132C 'solab':189C 'some':171C 'use':167C 'valid':101C 'verif':118C 'version':162C 'vulner':96C 'weaken':149C 'wide':107C 'without':117C 'zsirep':91C,131C 'zsirep.client.dll':94C","first_public_at":"2026-11-06T15:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cvd@cert.pl","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113618","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113618","severity":null,"published_at":"2026-11-06T15:17:08+00:00","modified_at":"2026-11-06T15:17:08+00:00","first_seen_at":"2026-11-06T15:42:43+00:00","fetched_at":"2026-11-06T15:42:43+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}