CVE-2026-65309 PUBLISHED

Storage of passwords in a reversible format

Assigner: CyberDanube
Reserved: 21.07.2026 Published: 31.07.2026 Updated: 31.07.2026

ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions stores and transmits user passwords using a reversible format instead of a one-way password hash. This allows an attacker able to read the credential store or capture network traffic to recover all stored passwords.

Metrics

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS Score: 7.5

Product Status

Vendor ANDRITZ
Product HIPASE-250
Versions Default: affected
  • affected from 0 to 7.20 (incl.)
  • Version 7.50 is unaffected
Vendor ANDRITZ
Product 250 SCALA
Versions Default: affected
  • affected from 0 to 7.20 (incl.)
  • Version 7.50 is unaffected

Credits

  • Duc Anh Nguyen (NTCS OT Penetration Testing Team) finder
  • Ta Duc Thien (NTCS OT Penetration Testing Team) finder

References

Problem Types

  • CWE-327 CWE
  • CWE-257 Storing passwords in a recoverable format CWE

Impacts

  • CAPEC-50 Password Recovery Exploitation