Description
The HTTP server component of ANDRITZ HIPASE-250 (formerly 250 SCALA)
in affected versions exposes an undocumented endpoint that changes
the server's logging level and target without requiring
authentication. A remote, unauthenticated attacker with network
access to the service may suppress audit logging, potentially
concealing other activity on the system.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ANDRITZ | HIPASE-250 | ≤ 7.20 | 8.00 |
| ANDRITZ | 250 SCALA | ≤ 7.20 | 8.00 |
Advisories 1
- ICSA-26-225-05 ANDRITZ HIPASE-250 and 250 SCALA CISA ICS & IT advisories · Aug 13, 2026