Murrelektronik aas-edge-client: Missing authentication in REST API
Summary
The aas-edge-client is a reference implementation of an Asset Administration Shell edge application published by Murrelektronik for a testbed demonstrator. Its REST API listens on all network interfaces on TCP port 18000, requires no authentication and accepts cross-origin requests from any origin. An unauthenticated remote attacker can read all data exposed by the GET endpoints and modify submodel data via PATCH requests, and a malicious web page opened by a user on a reachable network can do the same. Modified data is forwarded to the configured central AAS server.
Affected
- Murrelektronik Software AAS Edge Client, all versions (CNA lists version 0.0.0 as a placeholder; no versioned range known)
Fixed in
- Unknown. The vendor will not provide a fix; the product is no longer maintained.
Workaround
- Discontinue use of the aas-edge-client and remove existing deployments, copies of the source code and container images.
- Until removal is complete, isolate the host on a restricted network segment reachable only by authorised systems.
Exploitation
- No confirmed in-the-wild exploitation reported.
- Not listed in CISA KEV.
- CISA SSVC: exploitation none, automatable yes, technical impact total.
- A third-party proof-of-concept repository exists on GitHub; its content was not reviewed.
- EPSS about 0.3%.
Our recommendation
- Check whether any aas-edge-client instance or container is installed.
- Remove the product, its source code and container images from all environments.
- Check whether any aas-edge-client instance is reachable from outside the OT or LAN segment.
- Review the data received by the central AAS server for manipulated values.
- Rotate credentials or secrets stored on or reachable from affected hosts.
- Monitor for unexpected PATCH requests to the AAS API.
Public exploits
Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.
- Proof of concept on GitHub (1 repositories)
KernelEditor/CVE-2026-94293
Research sources
- CERT VDE Advisory VDE-2026-108 www.certvde.com
- Murrelektronik aas-edge-client repository github.com
- SecurityOnline: aas-edge-client vulnerability CVE-2026-94293 securityonline.info
- OffSeq Radar: CVE-2026-94293 radar.offseq.com
- Strix: CVE-2026-94293 www.strix.ai
- CVE-2026-94293 proof-of-concept repository (third-party) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:23.
Original description (NVD)
An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.