Vulnerabilities

CVSS

7.5 High

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Risk score

60.0

Published

2026-07-31

Status

Deferred

ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration of affected versions, exposes its data and configuration endpoint without any authentication and permissive CORS on every response. An unauthenticated attacker with network access can read live process values and server configuration.

Weaknesses

CWE-306CWE-942

Coverage 1

vulnerability

ANDRITZ HIPASE-250 and 250 SCALA

ANDRITZ HIPASE-250 and 250 SCALA devices, versions <=7.20, are vulnerable to several security flaws that could allow an attacker to read stored passwords, access configuration endpoints without authentication, and gain V…

CISA Advisories · Aug 13, 2026 High

CVE-2026-65309CVE-2026-65310CVE-2026-65311vulnerabilitypasswordauthentication

All articles mentioning it

Advisories and references

• andritz.com/