Skip to content
OpenAdvisories

Vendor

ANDRITZ

4 known vulnerabilities.

ANDRITZ at a glance

Last 12 months
4
Critical · all time
0
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 3 5 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 4 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202640
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

HIPASE-250 4 250 SCALA 4

Latest advisories

  • High max 8.1
    ICSA-26-225-05 4 CVEs

    ANDRITZ HIPASE-250 and 250 SCALA

    Successful exploitation of these vulnerabilities could allow an attacker to read data from the device or gain access to affected workstations.

    ANDRITZ
All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • High 8.1
    CVE-2026-65313

    Use of hard-coded VNC credentials in the engineering-workstation provisioning

    A provisioning script used when installing HIPASE-250 (formerly 250 SCALA) engineering workstations sets a fixed, hard-coded x11vnc password. Because the same credential is applied to every workstation provisioned this way, an attacker with adjacent-network a…

    ANDRITZ 250 SCALA HIPASE-250
  • Medium 5.3
    CVE-2026-65311

    Missing authentication for logging-configuration endpoint

    The HTTP server component of ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions exposes an undocumented endpoint that changes the server's logging level and target without requiring authentication. A remote, unauthenticated attacker with network acc…

    ANDRITZ HIPASE-250 250 SCALA
  • High 7.5
    CVE-2026-65310

    Missing authentication and permissive CORS policy

    ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration of affected versions, exposes its data and configuration endpoint without any authentication and permissive CORS on every response. An unauthenticated attacker with network access can read …

    ANDRITZ HIPASE-250 250 SCALA
  • High 7.5
    CVE-2026-65309

    Storage of passwords in a reversible format

    ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions stores and transmits user passwords using a reversible format instead of a one-way password hash. This allows an attacker able to read the credential store or capture network traffic to recover all …

    ANDRITZ 250 SCALA HIPASE-250