Paper/Archive/CVE-2026-94293

CVE-2026-94293

Murrelektronik Software AAS Edge Client all versions — Missing authentication for critical function in the aas-edge-client REST API

EPSS 0.4%CVSS 9.8

critical.is priorityof 100

CVSS 9.8 (CNA)9.8 / 10 × 3029.4 Not in CISA KEV+300.0 EPSS percentile 33.9.339 × 206.8 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints.

Affected

ProductAffectedFixed inSource

Software AAS Edge Client all versions0.0.0–CNA

Scores by source

CERTVDE (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CERTVDE (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refcertvde.com/en/advisories/VDE-2026-108