Skip to content
OpenAdvisories
High ICSA-26-225-05 4 CVEs

ANDRITZ HIPASE-250 and 250 SCALA

Published Aug 13, 2026 · Updated Aug 13, 2026

Vendor: ANDRITZ Product: 250 SCALA Product: HIPASE-250

Summary

Successful exploitation of these vulnerabilities could allow an attacker to read data from the device or gain access to affected workstations.

Vulnerabilities 4

  • High 8.1
    CVE-2026-65313

    Use of hard-coded VNC credentials in the engineering-workstation provisioning

    A provisioning script used when installing HIPASE-250 (formerly 250 SCALA) engineering workstations sets a fixed, hard-coded x11vnc password. Because the same credential is applied to every workstation provisioned this way, an attacker with adjacent-network a…

    ANDRITZ 250 SCALA HIPASE-250
  • High 7.5
    CVE-2026-65309

    Storage of passwords in a reversible format

    ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions stores and transmits user passwords using a reversible format instead of a one-way password hash. This allows an attacker able to read the credential store or capture network traffic to recover all …

    ANDRITZ 250 SCALA HIPASE-250
  • High 7.5
    CVE-2026-65310

    Missing authentication and permissive CORS policy

    ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration of affected versions, exposes its data and configuration endpoint without any authentication and permissive CORS on every response. An unauthenticated attacker with network access can read …

    ANDRITZ HIPASE-250 250 SCALA
  • Medium 5.3
    CVE-2026-65311

    Missing authentication for logging-configuration endpoint

    The HTTP server component of ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions exposes an undocumented endpoint that changes the server's logging level and target without requiring authentication. A remote, unauthenticated attacker with network acc…

    ANDRITZ HIPASE-250 250 SCALA

Revision history

  1. #1

    Initial Publication

References