Threat video1:00
CVE-2026-113618 KAMSOFT ZSIRep MITM: Detection & IOCs
ZSIRep CLIENT accepts any HTTPS certificate, exposing logins and documents to MITM. 9 detection rules, 10 IOCs and a free Splunk SPL rule are included.
Read the full threat intel for CVE-2026-113618 KAMSOFT ZSIRep MITM: Detection & IOCs →
Chapters
- 0:00The hookOne flaw breaks certificate validation for five products.
- 0:04The storyResearchers in a lab reproduced the missing server-certificate validation in ZSIRep CLIENT.
- 0:12Attack pathAccording to CERT Polska, missing certificate validation enables a man-in-the-middle attack.
- 0:29AttributionNo threat actor: this was defensive research.
- 0:34Indicators of compromise7 indicators to hunt: 1 file name and 6 package names.
- 0:39MITRE ATT&CK techniques3 ATT&CK techniques, from credential access to impact.
- 0:44Remediation3 steps now: Upgrade ZSIRep CLIENT library.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00One flaw breaks certificate validation for five products.
0:05Researchers in a lab reproduced the missing server-certificate validation in ZSIRep CLIENT.
0:12According to CERT Polska, missing certificate validation enables a man-in-the-middle attack.
0:18The attacker impersonates the server and intercepts authentication data.
0:23The callback persists after close, affecting other HTTPS connections.
0:30No threat actor: this was defensive research.
0:347 indicators to hunt: 1 file name and 6 package names.
0:393 ATT&CK techniques, from credential access to impact.
0:443 steps now: Upgrade ZSIRep CLIENT library.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.