CVE-2026-65310

HighCVSS 7.5

Published: 31/07/2026(UTC)Updated: 28/08/2026(UTC)Translated: 31/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.32%

24th percentile - higher than 24% of all known CVEs

Summary

ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration, exposes its data and configuration endpoint without any authentication and permissive CORS. An unauthenticated attacker with network access can read live process values and server configuration.

Risk Assessment

An attacker can obtain sensitive process data and configuration, potentially leading to compromise of industrial processes.

Recommendation

Configure authentication for data and configuration endpoints and restrict network access to trusted hosts only.

Other vulnerabilities in HIPASE-250

CVE-2026-65313High
A provisioning script used when installing HIPASE-250 (formerly 250 SCALA) engineering workstations sets a fixed, hard-coded x11vnc password. Because the same credential is applied to every workstation, an attacker with adjacent-network access who knows the password can gain VNC access to affected workstations.

Original NVD description (English source)

ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration of affected versions, exposes its data and configuration endpoint without any authentication and permissive CORS on every response. An unauthenticated attacker with network access can read live process values and server configuration.