CVE-2026-65310
Received Received - Intake

Unauthenticated Data Exposure in ANDRITZ HIPASE-250

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: CyberDanube

Description
ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration of affected versions, exposes its data and configuration endpoint without any authentication and permissive CORS on every response. An unauthenticated attacker with network access can read live process values and server configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-65310
EUVD
EUVD-2026-51500

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
andritz hipase-250 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-942 The product uses a web-client protection mechanism such as a Content Security Policy (CSP) or cross-domain policy file, but the policy includes untrusted domains with which the web client is allowed to communicate.
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves ANDRITZ HIPASE-250 devices exposing their data and configuration endpoints without authentication and with permissive CORS settings. An attacker can access these endpoints over the network to read live process values and server configuration.

Detection Guidance

Check if the ANDRITZ HIPASE-250 endpoint is accessible without authentication by using network scanning tools like curl or nmap. Example commands: curl -v http://<target-ip>:<port>/ or nmap -p <port> --script http-vuln* <target-ip>.

Impact Analysis

An unauthenticated attacker could gain access to sensitive operational data and system configurations, potentially leading to unauthorized monitoring, data exfiltration, or manipulation of industrial processes.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and security, such as GDPR (data confidentiality) and HIPAA (protected health information integrity), due to unauthorized data exposure and lack of access controls.

Mitigation Strategies

Immediately restrict network access to the ANDRITZ HIPASE-250 endpoint using firewalls or network segmentation. Apply authentication and disable permissive CORS settings if possible. Contact ANDRITZ for official patches or updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-65310. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart