CVE-2026-65311

MediumCVSS 5.3

Published: 31/07/2026(UTC)Updated: 28/08/2026(UTC)Translated: 31/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

19th percentile - higher than 19% of all known CVEs

Summary

The HTTP server in ANDRITZ HIPASE-250 (formerly 250 SCALA) exposes an undocumented endpoint that changes logging level and target without authentication. A remote, unauthenticated attacker can suppress audit logging, potentially concealing other activity on the system.

Risk Assessment

An attacker can hide their activity, making breach detection difficult and potentially leading to prolonged unauthorized presence in the system.

Recommendation

Update ANDRITZ HIPASE-250 software to the latest version that fixes this vulnerability. Restrict network access to the HTTP server to trusted hosts only.

Other vulnerabilities in ANDRITZ HIPASE-250

CVE-2026-65309High
ANDRITZ HIPASE-250 stores and transmits user passwords in a reversible format instead of a one-way hash. This allows an attacker to recover all stored passwords by reading the credential store or capturing network traffic.

Original NVD description (English source)

The HTTP server component of ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions exposes an undocumented endpoint that changes the server's logging level and target without requiring authentication. A remote, unauthenticated attacker with network access to the service may suppress audit logging, potentially concealing other activity on the system.