Hard-coded credentials and unauthenticated flaws expose ANDRITZ HIPASE-250 process data and workstations
Critical vulnerabilities in the ANDRITZ HIPASE-250 system allow unauthenticated attackers to steal passwords, view live process data, and suppress audit logs. Most notably, a hard-coded password in provisioning scripts enables unauthorized VNC access to engineering workstations. Defenders should prioritize securing network access to these systems and reviewing workstation deployment procedures.
Summary
The ANDRITZ HIPASE-250 (formerly 250 SCALA) industrial control platform contains several high-severity flaws that compromise credential security, system visibility, and audit integrity. These vulnerabilities include the use of reversible password formats instead of one-way hashes, unauthenticated data endpoints, and a hard-coded VNC password used during workstation provisioning.
Technical details
The HIPASE-250 platform suffers from several distinct architectural weaknesses that impact different layers of the system:
Credential Exposure The system stores and transmits user passwords in a reversible format rather than using one-way hashes. An attacker capable of reading the credential store or capturing network traffic can recover all stored passwords (CVE-2026-65309).
Unauthenticated Data Access In its default configuration, HIPASE-250 exposes a data and configuration endpoint without any authentication requirements. This endpoint also permits permissive Cross-Origin Resource Sharing (CORS) on every response, allowing unauthenticated attackers with network access to read live process values and server configurations (CVE-2026-65310).
Log Suppression The HTTP server component includes an undocumented endpoint that allows a remote, unauthenticated attacker to change the server's logging level and target. This capability can be used to suppress audit logging, effectively hiding subsequent malicious activity on the system (CVE-2026-65311).
Workstation Access via Hard-coded Credentials
A provisioning script used during the installation of HIPASE-250 engineering workstations applies a fixed, hard-coded x11vnc password. Because this same credential is applied to every workstation provisioned through this method, an attacker with adjacent-network access can gain VNC access to any affected workstation (CVE-2026-65313).
Affected products and fixed versions
The following vulnerabilities specifically impact the ANDRITZ HIPASE-250 (formerly 250 SCALA) product:
| CVE | Severity | Impact |
|---|---|---|
| CVE-2026-65309 | High (7.5) | Password recovery via reversible storage |
| CVE-2026-65310 | High (7.5) | Unauthenticated access to process values/config |
| CVE-2026-65311 | Medium (5.3) | Audit log suppression via undocumented endpoint |
| CVE-2026-65313 | High (8.1) | VNC access via hard-coded provisioning password |
Defender guidance
Defenders managing HIPASE-250 deployments should implement the following controls:
- Network Segmentation: Restrict network access to the HIPASE-250 service and its configuration endpoints. Ensure that these services are not reachable from untrusted or external networks.
- Workstation Audit: Inspect engineering workstations provisioned via the automated script. Verify if the
x11vncpassword can be changed or if a new, unique credential can be applied to prevent unauthorized V-NC access. - Monitor Logging Integrity: Watch for unexpected changes in logging levels or destinations, which may indicate an attempt to suppress audit trails via the undocumented HTTP endpoint.
- Traffic Inspection: Monitor network traffic for unauthenticated requests to data and configuration endpoints that should be restricted.
Sources
