CVE-2026-65313

HighCVSS 8.1

Published: 31/07/2026(UTC)Updated: 28/08/2026(UTC)Translated: 31/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.18%

7th percentile - higher than 7% of all known CVEs

Summary

A provisioning script used when installing HIPASE-250 (formerly 250 SCALA) engineering workstations sets a fixed, hard-coded x11vnc password. Because the same credential is applied to every workstation, an attacker with adjacent-network access who knows the password can gain VNC access to affected workstations.

Risk Assessment

An attacker with local network access can gain remote desktop access to workstations, potentially leading to data theft or sabotage.

Recommendation

Change the default x11vnc password to a unique one per workstation and implement multi-factor authentication for VNC access.

Other vulnerabilities in HIPASE-250

CVE-2026-65310High
ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration, exposes its data and configuration endpoint without any authentication and permissive CORS. An unauthenticated attacker with network access can read live process values and server configuration.

Original NVD description (English source)

A provisioning script used when installing HIPASE-250 (formerly 250 SCALA) engineering workstations sets a fixed, hard-coded x11vnc password. Because the same credential is applied to every workstation provisioned this way, an attacker with adjacent-network access who knows the password can gain VNC access to affected workstations.