CVE-2026-121624— Nanosystems Supremo before 5.0.2.3874 Improper TLS Certificate Validation

Quick assessment

Affected

Nanosystems Supremo

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在版本 5.0.2.3874 之前的 Nanosystems Supremo（适用于 Windows 和 macOS）存在证书验证不当的漏洞，允许邻近攻击者通过提供不受信任的证书来拦截 TLS 连接。同一网络中的攻击者可利用自签名证书终止并中继客户端的 TLS 会话，从而窃取用户名、SHA-256 密码哈希值以及许可证代码。

CVSS 6.8 · Medium Updated Nov 04, 2026

Possible ATT&CK Techniques 2 AI

T1572 · Protocol Tunneling T1552 · Unsecured Credentials

Affected Version Matrix 1

Vendor	Product	Version Range	Status
Nanosystems	Supremo	`< 5.0.2.3874`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Nanosystems Supremo before 5.0.2.3874 Improper TLS Certificate Validation

Source: CVE Program / CVE List V5

Vulnerability Description

Nanosystems Supremo for Windows and macOS before 5.0.2.3874 contains an improper certificate validation vulnerability that allows adjacent attackers to intercept TLS connections by presenting untrusted certificates. Attackers on the same network can terminate and relay the client's TLS session using self-signed certificates to read usernames, SHA-256 password hashes, and license codes.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

证书验证不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Nanosystems	Supremo	0 ~ 5.0.2.3874	-

II. Public POCs for CVE-2026-121624

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-121624

请登录查看更多情报信息。

Other References for CVE-2026-121624 (4)

https://www.supremocontrol.com/changelog/ release-notes
https://pusi77.eu.org/blog/2026-11-03-supremo-tls-cve technical-description
https://www.supremocontrol.com/ product
https://www.vulncheck.com/advisories/nanosystems-supremo-before-5.0.2.3874-improper-tls-certificate-validation third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-121624

IV. Related Vulnerabilities

Same weakness: CWE-295