What is the CVSS score of CVE-2026-65310?

CVE-2026-65310 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

Which versions of ANDRITZ HIPASE-250 are affected by CVE-2026-65310?

ANDRITZ HIPASE-250 controllers expose operational and configuration data to unauthenticated network attackers due to permissive default CORS and absence of authentication requirements, creating…

How to fix or mitigate CVE-2026-65310?

Within 24 hours, identify and inventory all ANDRITZ HIPASE-250 devices across your network using network scanning tools; document their IP addresses, network locations, and connected systems. Within 7 days, implement network segmentation to restrict access to these devices to authorized engineering networks only, using firewall rules or industrial control system (ICS) DMZs; disable or restrict CORS settings if possible through device management interfaces. Within 30 days, contact ANDRITZ for guidance on available compensating controls or upgrade paths; consider deploying intrusion detection focused on the vulnerable endpoint; establish network access logging to detect unauthorized queries to the configuration and data endpoints.

ANDRITZ HIPASE-250 CVE-2026-65310

EUVD-2026-51500 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-07-31 CyberDanube

GHSA-7cj5-w2hx-f2wc

Authentication Bypass Hipase 250 250 Scala Andritz

7.5

CVSS 3.1 · Vendor: CyberDanube

Severity by source

Vendor (CyberDanube) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Default-config endpoint is network-reachable with no auth (AV:N/AC:L/PR:N/UI:N); impact is data disclosure only, so C:H with I:N and A:N.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CyberDanube).

CVSS VectorVendor: CyberDanube

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 08:50 vuln.today

CVE Published

Jul 31, 2026 - 07:26 cve.org

HIGH 7.5

DescriptionCVE.org

ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration of affected versions, exposes its data and configuration endpoint without any authentication and permissive CORS on every response. An unauthenticated attacker with network access can read live process values and server configuration.

AnalysisAI

Information disclosure in ANDRITZ HIPASE-250 (formerly 250 SCALA) lets any unauthenticated attacker with network reachability query the device's data and configuration endpoint, exposing live process values and full server configuration. The flaw stems from the default configuration shipping with no authentication and permissive CORS on every response, so no credentials or user interaction are required. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Technical ContextAI

HIPASE-250 is an ANDRITZ industrial protection/automation platform used in power-generation and substation environments (CPE cpe:2.3:a:andritz:hipase-250 and its predecessor cpe:2.3:a:andritz:250_scala). The root cause is CWE-306 (Missing Authentication for Critical Function): a sensitive data/configuration API endpoint is served without any authentication gate. Compounding this, the device returns permissive Cross-Origin Resource Sharing (CORS) headers on every response, which additionally allows a victim's browser on a routable network to be leveraged to read responses cross-origin, widening the practical exposure of the already-open endpoint.

RemediationAI

No vendor-released patch or fixed version is identified in the available data, and the only reference is the vendor homepage (https://www.andritz.com/) rather than a dedicated advisory, so contact ANDRITZ to confirm a patched build. As compensating controls, restrict network access to the HIPASE-250 data/configuration endpoint using firewall or ACL rules so only authorized engineering workstations can reach it (trade-off: may disrupt legitimate monitoring integrations that currently poll the endpoint), place the device behind a segmented OT/ICS network or VPN per IEC 62443 zoning (trade-off: added operational overhead for remote access), and if the platform allows, tighten or disable the permissive CORS policy and enable any available authentication front-end/reverse proxy (trade-off: browser-based dashboards or cross-origin tooling relying on open CORS may break). Because integrity and availability are not affected, controls should prioritize confining who can read the endpoint.