AAS Edge Client EUVD-2026-92985

Exploitation requires network reachability to the AAS Edge Client's REST API that serves Asset Administration Shell submodel data; the attacker needs no credentials, no user interaction, and the flaw affects the product's GET and PATCH endpoints because they lack authentication (CWE-306). The input lists the product as 'all versions,' implying no version is known to be safe. The primary limiting factor is network exposure: risk is high where the API is reachable from untrusted or OT networks and substantially lower where the Edge Client is segmented behind firewalls or accessible only on isolated industrial networks. Authentication requirements are confirmed (PR:N) - no auth is needed.

This is a genuine high-priority issue, not an inflated high-CVSS score. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction, which is fully consistent with the description ('unauthenticated remote attacker') and the CWE-306 (Missing Authentication for Critical Function) classification - the signals agree with each other rather than conflicting. The impact claim is strong: attackers can both read all GET-exposed data (confidentiality) and modify submodel data via PATCH (integrity), mapping cleanly to VC:H/VI:H. The input's availability claim (VA:H) is not directly supported by the description, which mentions only read and modify operations - I have down-weighted availability in my own assessment and flag it as an inference rather than a confirmed impact. No EPSS score, SSVC decision, KEV listing, or POC indicator was supplied, so exploitation-probability and in-the-wild signals are absent; the current status is 'no public exploit identified at time of analysis.' The dominant risk driver is therefore the trivial exploitability (no auth, no interaction) against an industrial/IIoT component, tempered by the fact that real-world exposure depends heavily on whether the Edge Client's API is reachable from untrusted networks, which is unknown from the data.

An attacker with network access to the Murrelektronik AAS Edge Client API issues unauthenticated GET requests to harvest all exposed Asset Administration Shell data, then sends crafted PATCH requests to alter submodel values - potentially corrupting the digital-twin state that drives downstream industrial processes. Because no authentication is required and complexity is low, any party able to reach the endpoint can perform this; no public exploit code is identified at time of analysis, but the attack requires only standard HTTP tooling.