ANDRITZ HIPASE-250 and 250 SCALA Multiple Vulnerabilities
First seen Aug 16, 2026 · Updated Aug 16, 2026 · CVSS 8.1
ANDRITZ HIPASE-250 and 250 SCALA industrial control system products (versions <=7.20) contain four vulnerabilities including recoverable password storage, missing authentication on data/config endpoints, an unauthenticated logging manipulation endpoint, and a hard-coded VNC credential used across engineering workstation deployments. Successful exploitation could allow an attacker to read sensitive process data, access engineering workstations, suppress audit logs, or recover stored credentials. These are primarily energy-sector ICS/OT vulnerabilities with no reported public exploitation to date.
Technical Analysis
CVE-2026-65309 (CVSS 7.5) stores/transmits passwords in reversible format rather than hashed, allowing credential recovery from stores or network capture. CVE-2026-65310 (CVSS 7.5) exposes a data/configuration HTTP endpoint with no authentication and permissive CORS, letting unauthenticated attackers read live process values and configuration. CVE-2026-65311 (CVSS 5.3) allows unauthenticated remote manipulation of server logging levels, enabling attackers to suppress audit trails and conceal follow-on activity. CVE-2026-65313 (CVSS 8.1) results from a provisioning script that sets a fixed, hard-coded x11vnc password identically across all engineering workstations, granting adjacent-network attackers VNC access if the password is known. These flaws affect OT/ICS engineering environments rather than AI agent infrastructure directly, but any AI agent or automation system integrated into these energy-sector OT networks for monitoring, data ingestion, or workstation control could be exposed to credential theft or unauthorized command/data access if deployed on or adjacent to affected HIPASE-250/250 SCALA systems.
Affected Systems
ANDRITZ HIPASE-250 versions <=7.20; ANDRITZ 250 SCALA versions <=7.20 (formerly named product); fixed in V8.00.00 (Dec 2024) and V8.15.00 (Jul 2026)
Indicators of Compromise
- No specific IOCs provided; advisory notes no known public exploitation observed
Remediation Steps
- 1
Upgrade to patched version
Update ANDRITZ HIPASE-250/250 SCALA to version V8.00.00 or later, ideally the latest V8.15.00 release, which addresses all four CVEs.
- 2
Network segmentation
Isolate control system networks and devices from business networks and the internet; place behind firewalls.
- 3
Restrict remote access
Use VPNs for remote access where required, and keep VPN software updated; treat VPN security as dependent on endpoint device security.
- 4
Rotate hard-coded VNC credentials
Change the default/hard-coded x11vnc password on all provisioned engineering workstations and enforce unique credentials per host.
- 5
Audit logging and monitoring
Monitor for unauthorized changes to logging configuration and unusual network access to HTTP data/config endpoints; report suspected malicious activity to CISA.
- 6
Credential hygiene
Ensure passwords are stored using one-way hashing rather than reversible formats after upgrade, and rotate any credentials potentially exposed prior to patching.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.