CISA warns of four flaws in ANDRITZ HIPASE-250 and 250 SCALA systems
CISA said the flaws could let an attacker read device data, suppress logs or gain access to affected workstations, and noted the vendor has already issued fixes.
CISA published an industrial control systems advisory on Aug. 13 on four vulnerabilities in ANDRITZ HIPASE-250 and 250 SCALA devices and workstations, covering versions 7.20 and earlier.
The agency said successful exploitation could let an attacker read data from the device or gain access to affected workstations. The advisory places the products in the energy sector and says they are deployed worldwide.
CISA listed four CVEs: CVE-2026-65309, CVE-2026-65310, CVE-2026-65311 and CVE-2026-65313. The agency assigned CVSS v3.1 scores from 5.3 to 8.1, with two flaws rated 7.5, one rated 5.3 and one rated 8.1.
For CVE-2026-65309, CISA said the affected software stores and transmits user passwords in a reversible format instead of using a one-way hash. According to the advisory, someone who can read the credential store or capture network traffic could recover stored passwords. CISA mapped the issue to CWE-257 and rated it 7.5 under CVSS v3.1.
For CVE-2026-65310, CISA said the default configuration exposes a data and configuration endpoint without authentication and uses permissive CORS on every response. The agency said an unauthenticated attacker with network access could read live process values and server configuration. CISA mapped that issue to CWE-306 and rated it 7.5.
For CVE-2026-65311, CISA said an undocumented HTTP endpoint can change the server’s logging level and target without authentication. The agency said a remote attacker with network access may suppress audit logging and hide activity. CISA mapped the flaw to CWE-306 and gave it a CVSS v3.1 score of 5.3.
For CVE-2026-65313, CISA said a provisioning script used when installing HIPASE-250 engineering workstations sets a fixed x11vnc password. Because the same credential is used on every workstation provisioned this way, an attacker with adjacent-network access who knows the password can reach affected workstations through VNC, CISA said. The agency mapped the issue to CWE-798 and rated it 8.1.
CISA said ANDRITZ addressed the issues in V8.00.00, released in 2024-12, and in V8.15.00, released in 2026-07. CISA also said the current HIPASE-250 version is V8.15.00.
The advisory said no known public exploitation specifically targeting these vulnerabilities had been reported to CISA at the time of publication. It credited Duc Anh Nguyen and Ta Duc Thien of the NTCS OT Penetration Testing Team as reporters.
CISA recommended minimizing network exposure, placing control system networks behind firewalls and using updated VPNs when remote access is required. The advisory did not say whether users should take additional steps beyond installing the vendor fixes.
Sources
Editorial note: This article was prepared with AI assistance and includes source attribution for reader review.
Comments ()