What is the CVSS score of CVE-2026-65309?

CVE-2026-65309 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.2%.

Which versions of ANDRITZ HIPASE-250 are affected by CVE-2026-65309?

ANDRITZ HIPASE-250 industrial control platforms store user credentials in reversible password format rather than cryptographic hashes, exposing all stored passwords to anyone accessing the credential…

How to fix or mitigate CVE-2026-65309?

Within 24 hours: inventory all HIPASE-250 installations, map network access paths, and audit which systems and users access HIPASE-250 credentials. Within 7 days: implement network segmentation to restrict HIPASE-250 access to dedicated secure networks, enforce TLS/SSL for all data in transit, and reset all stored credentials on HIPASE-250 systems. Within 30 days: enforce a mandatory password change cycle for all users with HIPASE-250 access, establish continuous monitoring for unauthorized credential access or authentication anomalies, contact ANDRITZ to determine patch availability timeline, and evaluate compensating technical controls such as credential vaulting or network-level access restrictions if no patch is forthcoming.

ANDRITZ HIPASE-250 CVE-2026-65309

EUVD-2026-51488 HIGH

Use of a Broken or Risky Cryptographic Algorithm (CWE-327)

2026-07-31 CyberDanube

GHSA-9mhg-63g6-hvrp

Information Disclosure Hipase 250 250 Scala Andritz

7.5

CVSS 3.1 · Vendor: CyberDanube

Severity by source

Vendor (CyberDanube) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

6.5 MEDIUM

Recovery needs adjacent network capture or credential-store read access rather than pure remote reach, so AV:A; passive/low-complexity with confidentiality-only impact, hence C:H, I:N, A:N.

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CyberDanube).

CVSS VectorVendor: CyberDanube

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 07:50 vuln.today

CVE Published

Jul 31, 2026 - 07:17 cve.org

HIGH 7.5

DescriptionCVE.org

ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions stores and transmits user passwords using a reversible format instead of a one-way password hash. This allows an attacker able to read the credential store or capture network traffic to recover all stored passwords.

AnalysisAI

Sensitive credential exposure in ANDRITZ HIPASE-250 (formerly 250 SCALA) stems from storing and transmitting user passwords in a reversible format rather than as one-way hashes, letting anyone who can read the credential store or sniff network traffic recover every stored password in cleartext. The flaw affects the HIPASE-250 protection, control and monitoring platform and carries a CVSS 7.5 (confidentiality-only) rating. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; recovered credentials could enable follow-on authenticated access to the device or connected OT systems.

Technical ContextAI

HIPASE-250 is ANDRITZ's numerical protection, control and monitoring system used in power/hydro substation and plant automation (CPE cpe:2.3:a:andritz:hipase-250 and its predecessor cpe:2.3:a:andritz:250_scala). The root cause is classified as CWE-327 (Use of a Broken or Risky Cryptographic Algorithm): instead of applying a one-way, salted password hash (e.g. bcrypt/Argon2/PBKDF2), the product uses a reversible representation - encryption, encoding, or obfuscation that can be decrypted or decoded back to the original secret. Because the transformation is reversible, both the at-rest credential store and the over-the-wire transmission preserve enough information to reconstruct the plaintext password, defeating the entire purpose of password hashing.

RemediationAI

No vendor-released patch or fixed version was identified at time of analysis, and the only supplied reference is the ANDRITZ homepage (https://www.andritz.com/) - contact ANDRITZ or the reporting coordinator (CyberDanube) for a fixed build and advisory, and apply the vendor's password-storage fix (a proper salted one-way hash) once released. As compensating controls: isolate HIPASE-250 on a dedicated, segmented OT/management VLAN and restrict device and credential-store access to a hardened jump host (limits who can read the credential store, at the cost of added operational access friction); enforce encrypted transport (TLS/VPN) for all management sessions to defeat passive traffic capture (may require configuration changes and can break plaintext legacy tooling); rotate all HIPASE-250 passwords and avoid reusing them on other systems, since any previously exposed credential must be treated as compromised; and deploy network monitoring on the management segment to detect sniffing or anomalous credential-store reads. Note these controls reduce exposure but do not remove the underlying reversible-storage weakness.