CVE-2026-94293

Missing authentication for critical function in the aas-edge-client REST API PUBLISHED

Description (CNA)

An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints.

Affected (CNA)

Vendor / product	Versions
Murrelektronik / Software AAS Edge Client all versions	affected 0.0.0

CWE

CWE-306

References

https://www.certvde.com/en/advisories/VDE-2026-108/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.