CVE-2026-65310 PUBLISHED

Missing authentication and permissive CORS policy

Assigner: CyberDanube
Reserved: 21.07.2026 Published: 31.07.2026 Updated: 31.07.2026

ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration of affected versions, exposes its data and configuration endpoint without any authentication and permissive CORS on every response. An unauthenticated attacker with network access can read live process values and server configuration.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS Score: 7.5

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	ANDRITZ
Product	HIPASE-250
Versions	Default: affected affected from 0 to 7.20 (incl.) Version 7.40 is unaffected

Vendor	ANDRITZ
Product	250 SCALA
Versions	Default: affected affected from 0 to 7.20 (incl.) Version 7.40 is unaffected

Credits

Duc Anh Nguyen (NTCS OT Penetration Testing Team) finder
Ta Duc Thien (NTCS OT Penetration Testing Team) finder

References

https://www.andritz.com/

Problem Types

CWE-306 Missing authentication for critical function CWE
CWE-942 Permissive cross-domain security policy with untrusted domains CWE

Impacts

CAPEC-36 Using Unpublished Interfaces or Functionality