Description
A provisioning script used when installing HIPASE-250 (formerly 250
SCALA) engineering workstations sets a fixed, hard-coded x11vnc
password. Because the same credential is applied to every workstation
provisioned this way, an attacker with adjacent-network access who
knows the password can gain VNC access to affected workstations.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ANDRITZ | HIPASE-250 | ≤ 7.20 | 8.15 |
| ANDRITZ | 250 SCALA | ≤ 7.20 | 8.15 |
Advisories 1
- ICSA-26-225-05 ANDRITZ HIPASE-250 and 250 SCALA CISA ICS & IT advisories · Aug 13, 2026