Nanosystems Supremo before 5.0.2.3874 Improper TLS Certificate Validation

Advisories

Nanosystems Supremo before 5.0.2.3874 Improper TLS Certificate Validation

Severity: high
Date: 11/3/2026
Affecting: Supremo >= 0, < 5.0.2.3874
CVE: CVE-2026-121624
CWE: CWE-295 Improper Certificate Validation
CVSS: 7.6
CVSS V4 Vector: CVSS:4.0/AV:A/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
References: https://pusi77.eu.org/blog/2026-11-03-supremo-tls-cve
https://www.supremocontrol.com/changelog/
https://www.supremocontrol.com/
Credit: Andrea Pusineri
Description: Nanosystems Supremo for Windows and macOS before 5.0.2.3874 contains an improper certificate validation vulnerability that allows adjacent attackers to intercept TLS connections by presenting untrusted certificates. Attackers on the same network can terminate and relay the client's TLS session using self-signed certificates to read usernames, SHA-256 password hashes, and license codes.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo