ANDRITZ HIPASE-250 and 250 SCALA: 4 CVEs, High 8.1
Summary
CISA reports 4 vulnerabilities in ANDRITZ HIPASE-250, 250 SCALA. Weakness types: Storing Passwords in a Recoverable Format, Missing Authentication for Critical Function, Use of Hard-coded Credentials. Successful exploitation of these vulnerabilities could allow an attacker to read data from the device or gain access to affected workstations. Highest CVSS v3 score: 8.1 (High), exploitable from an adjacent network.
At a glance
- Vendor
- ANDRITZ
- Products
- HIPASE-250, 250 SCALA
- CVEs
- CVE-2026-65309, CVE-2026-65310, CVE-2026-65311, CVE-2026-65313
- Highest CVSS v3
- 8.1 CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Highest CVSS v4
- –
- Known exploited (KEV)
- No CVE from this advisory is on the KEV list as of the last refresh
- Sectors (per CISA)
- Energy
- Deployed
- Worldwide
- Vendor HQ
- Austria
Vulnerabilities
| CVE | Weakness | CVSS v3 | CVSS v4 | KEV | Description (from advisory) |
|---|---|---|---|---|---|
| CVE-2026-65309 | Storing Passwords in a Recoverable Format | 7.5 | – | No | ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions stores and transmits user passwords using a reversible format instead of a one-way password hash. This allows an attacker able to read the credential store or capture network traffic to recover all stored passwords. |
| CVE-2026-65310 | Missing Authentication for Critical Function | 7.5 | – | No | ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration of affected versions, exposes its data and configuration endpoint without any authentication and permissive CORS on every response. An unauthenticated attacker with network access can read live process values and server configuration. |
| CVE-2026-65311 | Missing Authentication for Critical Function | 5.3 | – | No | The HTTP server component of ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions exposes an undocumented endpoint that changes the server's logging level and target without requiring authentication. A remote, unauthenticated attacker with network access to the service may suppress audit logging, potentially concealing other activity on the system. |
| CVE-2026-65313 | Use of Hard-coded Credentials | 8.1 | – | No | A provisioning script used when installing HIPASE-250 (formerly 250 SCALA) engineering workstations sets a fixed, hard-coded x11vnc password. Because the same credential is applied to every workstation provisioned this way, an attacker with adjacent-network access who knows the password can gain VNC access to affected workstations. |
Affected products (2)
- ANDRITZ HIPASE-250: <=7.20
- ANDRITZ 250 SCALA: <=7.20
Vendor fixes and mitigations (from advisory)
- Vendor Fix: ANDRITZ has addressed these issues in version V8.00.00 (released 2024-12) and in version V8.15.00 (released 2026-07) and encourages users to keep their systems updated to the latest version (currently HIPASE-250 Version V8.15.00). For more information, users can contact ANDRITZ at the following website: https://www.andritz.com/group-en/contact link
Also apply CISA's standard ICS practices: minimize network exposure, keep control networks behind firewalls and isolated from business networks, and use up-to-date secure remote access.
Sources
This page is generated automatically from the CISA advisory text. It is not a substitute for the vendor's guidance; verify affected versions and fixes at the source before making changes to control systems.