{"metadata": {"vulnerability": "CVE-2026-94293", "count": 24, "kinds": {"milestone": 5, "sighting": 7, "kev": 0, "other": 12}}, "data": [{"timestamp": "2026-09-18T06:15:00Z", "date_only": false, "value": "2026-09-18T06:15:00Z", "kind": "other", "label": "Discovery date", "source": "csaf_murrelektronikgmbh \u00b7 VDE-2026-108", "record": "VDE-2026-108", "field": "vulnerabilities.0.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event"}, {"timestamp": "2026-09-21T09:39:23.739Z", "date_only": false, "value": "2026-09-21T09:39:23.739Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-94293", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-02T09:28:39.682Z", "date_only": false, "value": "2026-10-02T09:28:39.682Z", "kind": "other", "label": "Document generated", "source": "csaf_murrelektronikgmbh \u00b7 VDE-2026-108", "record": "VDE-2026-108", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-06T06:37:38.898Z", "date_only": false, "value": "2026-10-06T06:37:38.898288Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/certvde/statuses/117392582452388550", "record": "CVE-2026-94293", "field": "creation_timestamp", "uuid": "43e7fca4-517c-4564-ba4c-7d6fc22a861d", "content": "\ud83d\udd12 New CSAF advisory published\nVDE-2026-108Murrelektronik: Missing Authentication in aas-edge-client Reference Implementation allows Manipulation of AAS DataCVE-2026-94293\nThe aas-edge-client is a reference implementation of an Asset Administration Shell (AAS) edge application, published by Murrelektronik GmbH on GitHub for\u2026\nHTML: https://certvde.com/en/advisories/vde-2026-108/CSAF JSON: https://murrelektronik.csaf-tp.certvde.com/.well-known/csaf/white/2026/vde-2026-108.json\n#OT #Advisory", "url": "https://infosec.exchange/users/certvde/statuses/117392582452388550"}, {"timestamp": "2026-10-06T06:38:04.271Z", "date_only": false, "value": "2026-10-06T06:38:04.271Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-94293", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-06T06:38:04.271Z", "date_only": false, "value": "2026-10-06T06:38:04.271Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CERTVDE", "record": "CVE-2026-94293", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-06T06:39:27.254Z", "date_only": false, "value": "2026-10-06T06:39:27.254096Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/certvde.infosec.exchange.ap.brid.gy/post/3mx6t27q6yar2", "record": "CVE-2026-94293", "field": "creation_timestamp", "uuid": "bcb2cde6-ac07-4095-b5f6-07ef4dab8b5f", "content": "\ud83d\udd12 New CSAF advisory published\n\nVDE-2026-108\nMurrelektronik: Missing Authentication in aas-edge-client Reference Implementation allows Manipulation of AAS Data\nCVE-2026-94293\n\nThe aas-edge-client is a reference implementation of an Asset Administration Shell (AAS) edge application, published by [\u2026]", "url": "https://bsky.app/profile/certvde.infosec.exchange.ap.brid.gy/post/3mx6t27q6yar2"}, {"timestamp": "2026-10-06T07:17:00Z", "date_only": false, "value": "2026-10-06T07:17:00Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-38W2-7JV3-258F", "record": "GHSA-38W2-7JV3-258F", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-06T07:17:00.193Z", "date_only": false, "value": "2026-10-06T07:17:00.193", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-94293", "record": "FKIE_CVE-2026-94293", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-06T07:50:14.372Z", "date_only": false, "value": "2026-10-06T07:50:14.372761Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3ymage22fl55s", "record": "CVE-2026-94293", "field": "creation_timestamp", "uuid": "96349b13-9ab6-4d30-9728-174fe3245d87", "content": "CVE-2026-94293 - Missing authentication for critical function in the aas-edge-client REST API\nCVE ID : CVE-2026-94293\n \n Published : Oct. 6, 2026, 6:38 a.m. | 35\u00a0minutes ago\n \n Description : An unauthenticated remote attacker can modify Asset Administration Shell submodel data...", "url": "https://bsky.app/profile/cve.skyfleet.blue/post/3ymage22fl55s"}, {"timestamp": "2026-10-06T08:07:13.846Z", "date_only": false, "value": "2026-10-06T08:07:13.846242Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mx6xyaz23c2z", "record": "CVE-2026-94293", "field": "creation_timestamp", "uuid": "70706a23-06fb-403e-9620-2ccdba96ef0a", "content": "\ud83d\udea8 CVE-2026-94293 \u2014 CVSS 9.3 CRITICAL\n\nAn unauthenticated remote attacker can modify Asset Administration Shell submodel data via PATCH requests a...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-94293\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mx6xyaz23c2z"}, {"timestamp": "2026-10-06T09:31:23Z", "date_only": false, "value": "2026-10-06T09:31:23Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-38W2-7JV3-258F", "record": "GHSA-38W2-7JV3-258F", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-06T09:31:23Z", "date_only": false, "value": "2026-10-06T09:31:23Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-38W2-7JV3-258F", "record": "GHSA-38W2-7JV3-258F", "field": "modified"}, {"timestamp": "2026-10-06T10:00:00Z", "date_only": false, "value": "2026-10-06T10:00:00.000Z", "kind": "other", "label": "Advisory revision", "source": "csaf_murrelektronikgmbh \u00b7 VDE-2026-108", "record": "VDE-2026-108", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-10-06T10:00:00Z", "date_only": false, "value": "2026-10-06T10:00:00.000Z", "kind": "milestone", "label": "Published", "source": "csaf_murrelektronikgmbh \u00b7 VDE-2026-108", "record": "VDE-2026-108", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-10-06T10:00:00Z", "date_only": false, "value": "2026-10-06T10:00:00.000Z", "kind": "other", "label": "Updated", "source": "csaf_murrelektronikgmbh \u00b7 VDE-2026-108", "record": "VDE-2026-108", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-06T10:43:24.568Z", "date_only": false, "value": "2026-10-06T10:43:24.568763Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3mx7apj5vou23", "record": "CVE-2026-94293", "field": "creation_timestamp", "uuid": "2e8b0013-cee4-4f0d-ac23-52df6b92f02c", "content": "Murrelektronik won't fix AAS edge client vulnerability CVE-2026-94293 (CVSS 9.8), which allows unauthenticated data changes. Remove it now.\n\n#Murrelektronik #AAS #CVE202694293 #ICS #OTSecurity #Industry40 #MissingAuthentication #Vulnerability", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3mx7apj5vou23"}, {"timestamp": "2026-10-06T17:20:08.746Z", "date_only": false, "value": "2026-10-06T17:20:08.746845Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-94293", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-06T17:20:08.746Z", "date_only": false, "value": "2026-10-06T17:20:08.746845Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-94293", "record": "FKIE_CVE-2026-94293", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-06T17:21:28.971Z", "date_only": false, "value": "2026-10-06T17:21:28.971Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-94293", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-06T17:21:28.971Z", "date_only": false, "value": "2026-10-06T17:21:28.971Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-94293", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-06T18:16:58.550Z", "date_only": false, "value": "2026-10-06T18:16:58.550", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-94293", "record": "FKIE_CVE-2026-94293", "field": "lastModified"}, {"timestamp": "2026-10-07T20:00:07.036Z", "date_only": false, "value": "2026-10-07T20:00:07.036539Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxcqbwdafa2n", "record": "CVE-2026-94293", "field": "creation_timestamp", "uuid": "bbd5cf9f-e35e-4d71-864a-b7875f45c4f9", "content": "CVE-2026-94293 - software aas edge client all versions\nThe AAS Edge Client software does not require a login for its web interface, so anyone on the network can send requests to read or modify the data it\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#murrelektronik #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxcqbwdafa2n"}, {"timestamp": "2026-10-08T07:30:23.673Z", "date_only": false, "value": "2026-10-08T07:30:23.673534Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/getpacketai.bsky.social/post/3mxdwua4f4j2o", "record": "cve-2026-94293", "field": "creation_timestamp", "uuid": "7d121e31-f66b-424d-972f-119c4bebe8de", "content": "Critical IIoT vulnerability: Murrelektronik's AAS Edge Client exposes unauthenticated REST APIs for data tampering with no patch available. Check\u2026\n\nhttps://dev.to/threataft_dev/cve-2026-94293-aas-edge-client-cvss-98-iiot-data-tampering-no-patch-decommission-now-4dpi\n\n#edge #IoT", "url": "https://bsky.app/profile/getpacketai.bsky.social/post/3mxdwua4f4j2o"}], "metrics": {"as_of": "2026-10-30T01:32:52.278Z", "anchors": {"origin": {"timestamp": "2026-09-18T06:15:00Z", "date_only": false, "value": "2026-09-18T06:15:00Z", "kind": "other", "label": "Discovery date", "source": "csaf_murrelektronikgmbh \u00b7 VDE-2026-108", "record": "VDE-2026-108", "field": "vulnerabilities.0.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event"}, "discovery": {"timestamp": "2026-09-18T06:15:00Z", "date_only": false, "value": "2026-09-18T06:15:00Z", "kind": "other", "label": "Discovery date", "source": "csaf_murrelektronikgmbh \u00b7 VDE-2026-108", "record": "VDE-2026-108", "field": "vulnerabilities.0.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event"}, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-10-06T06:38:04.271Z", "date_only": false, "value": "2026-10-06T06:38:04.271Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-94293", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": null, "exploitation": null, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit": {"available": false, "missing": ["end"]}, "disclosure_to_exploit_publication": {"available": false, "missing": ["end"]}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 3611872.278537, "hours": 1003.2978551491667, "days": 41.804077297881946, "min_seconds": 3611872.278537, "max_seconds": 3611872.278537, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-09-18T06:15:00Z", "date_only": false, "value": "2026-09-18T06:15:00Z", "kind": "other", "label": "Discovery date", "source": "csaf_murrelektronikgmbh \u00b7 VDE-2026-108", "record": "VDE-2026-108", "field": "vulnerabilities.0.discovery_date", "metric_role": "discovery", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-30T01:32:52.278Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": false, "missing": ["start"]}, "exploit_publication_to_patch": {"available": false, "missing": ["start"]}}}