The vulnerability allows an unauthenticated remote attacker to execute HTTP PATCH requests against the aas-edge-client REST API, modifying Asset Administration Shell submodel data. In addition, the same attacker can retrieve all data exposed by the GET endpoints. This results in a compromise of data integrity, as the attacker can alter critical configuration and potentially disrupt automated processes that rely on the Asset Administration Shell. The weakness is Authentication Bypass (CWE‑306) and the CVSS score of 9.3 reflects the potential impact of both data tampering and disclosure.

All versions of Murrelektronik’s Software AAS Edge Client are affected. The vulnerability applies to every installation that exposes the REST API without additional authentication.

The high CVSS score of 9.3 indicates a critical risk level. Because the API requires no authentication, the attack vector is network‑based; any system or user with network access to the REST endpoint can exploit the flaw. EPSS data is not available, but the absence of a KEV listing suggests that exploitation by the broader threat community may not yet be confirmed. Nonetheless, the difficulty of exploitation is low and the potential compromise is severe, so the overall risk remains high.