Murrelektronik: Missing Authentication in aas-edge-client Reference Implementation allows Manipulation of AAS Data
The aas-edge-client is a reference implementation of an Asset Administration Shell (AAS) edge application, published by Murrelektronik GmbH on GitHub for the LNI 4.0 testbed demonstrator. Its REST API is bound to all network interfaces on TCP port 18000, requires no authentication and accepts cross-origin requests from any origin. The reference implementation was never intended for productive use and is no longer maintained. Affected are all aas-edge-client versions.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-94293US | critical9.8OT hoch | Exploit | ||
An unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests and can read all data exposed by the GET endpoints. | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- VDE-2026-108: Murrelektronik: Missing Authentication in aas-edge-client Reference Implementation allows Manipulation of AAS Data - HTMLself
- CERT@VDE Security Advisories for Murrelektronikexternal
- VDE-2026-108: Murrelektronik: Missing Authentication in aas-edge-client Reference Implementation allows Manipulation of AAS Data - CSAFself
- Murrelektronik Product Security Incident Response (PSIRT) Teamexternal
Behebungen (2)
- MitigationMurrelektronik Software AAS Edge Client all versions
Discontinue the use of the aas-edge-client and remove any existing deployments as well as copies of the source code and container image. The code must not be used in any environment.
- Kein Fix geplantMurrelektronik Software AAS Edge Client all versions
Murrelektronik will not provide a fix. The aas-edge-client was a reference implementation created solely for a trade-fair demonstrator and is no longer maintained. All repositories of the Murrelektronik GitHub organisation have been set to private, and the aas-edge-client repository has additionally been archived.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan