CVE-2026-65309

HighCVSS 7.5

Published: 31/07/2026(UTC)Updated: 28/08/2026(UTC)Translated: 31/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

5th percentile - higher than 5% of all known CVEs

Summary

ANDRITZ HIPASE-250 stores and transmits user passwords in a reversible format instead of a one-way hash. This allows an attacker to recover all stored passwords by reading the credential store or capturing network traffic.

Risk Assessment

An attacker can recover all user passwords, leading to full account compromise and system access.

Recommendation

Update ANDRITZ HIPASE-250 to a version that stores passwords using a secure, one-way hash.

Other vulnerabilities in ANDRITZ HIPASE-250

CVE-2026-65311Medium
The HTTP server in ANDRITZ HIPASE-250 (formerly 250 SCALA) exposes an undocumented endpoint that changes logging level and target without authentication. A remote, unauthenticated attacker can suppress audit logging, potentially concealing other activity on the system.

Original NVD description (English source)

ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions stores and transmits user passwords using a reversible format instead of a one-way password hash. This allows an attacker able to read the credential store or capture network traffic to recover all stored passwords.