According the the standard (https://cpe.mitre.org/files/cpe-specification_2.2.pdf), it should mean NA:
"It is often necessary to use a CPE Name when identifying a specific release of a given platform.
If attempting to create a CPE Name for this, and a specific co
mponent is not applicable to the
given platform, then the term '-' should be used. Note that use of the '-' term is different than leaving the component blank, even though in practice both options might identify with the same set of platform types. For example, an application may not have different editions. A CPE Name for such an application may use the '-' term for the edition component."
From the usage, it certainly appears to mean null, more often than not.