CVE-2026-94293
Received Received - Intake

Unauthenticated PATCH Requests Modify Asset Administration Shell Submodel Data

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: CERT VDE

Description
An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-06
AI Q&A
2026-10-06
EPSS Evaluated
N/A
NVD
CVE-2026-94293
EUVD
EUVD-2026-92985

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Murrelektronik Software AAS Edge Client all versions 0.0.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability allows an unauthenticated remote attacker to read and modify Asset Administration Shell (AAS) submodel data via PATCH requests. The affected application, aas-edge-client, exposes a REST API on TCP port 18000 without authentication and accepts cross-origin requests from any origin. The application was a temporary demonstrator and is no longer maintained.

Detection Guidance

Check if the aas-edge-client is running on TCP port 18000 by using commands like 'netstat -tuln | grep 18000' or 'ss -tuln | grep 18000'. If the port is open and the service is running, the system is likely vulnerable.

Impact Analysis

An attacker could read sensitive device information or modify data stored locally and forwarded to a central AAS server. This could lead to manipulated device information being received by systems consuming that server, potentially causing incorrect operations or data integrity issues.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating GDPR (data protection) and HIPAA (health information privacy) requirements. Unauthorized modifications to device data could also result in non-compliance with integrity and accountability standards.

Mitigation Strategies

Immediately stop using the aas-edge-client, remove all deployments, and delete any copies of the source code or container image. Since no fix will be provided, discontinuing use is the only mitigation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94293. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart