Software Aas Edge Client All Versions
Monthly
Unauthenticated attackers who can reach the Murr Elektronik AAS Edge Client (all versions) REST API can read every data set exposed by its GET endpoints and alter Asset Administration Shell submodel data through PATCH requests, because those endpoints were deployed without any authentication (CWE-306). The issue is scored 9.3 under CVSS 4.0 and 9.1 under our CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting trivial network-only reachability, no credential requirement, and high confidentiality and integrity impact; availability is not affected in our assessment. No public exploit code and no CISA KEV listing were identified at time of analysis, so actual risk is driven almost entirely by exposure: high where the Edge Client API sits on an untrusted or flat OT network, substantially lower where it is segmented behind firewalls or confined to isolated industrial networks.
Unauthenticated attackers who can reach the Murr Elektronik AAS Edge Client (all versions) REST API can read every data set exposed by its GET endpoints and alter Asset Administration Shell submodel data through PATCH requests, because those endpoints were deployed without any authentication (CWE-306). The issue is scored 9.3 under CVSS 4.0 and 9.1 under our CVSS 3.1 assessment (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N), reflecting trivial network-only reachability, no credential requirement, and high confidentiality and integrity impact; availability is not affected in our assessment. No public exploit code and no CISA KEV listing were identified at time of analysis, so actual risk is driven almost entirely by exposure: high where the Edge Client API sits on an untrusted or flat OT network, substantially lower where it is segmented behind firewalls or confined to isolated industrial networks.