What is the CVSS score of CVE-2026-65313?

CVE-2026-65313 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.2%.

Which versions of HIPASE-250 are affected by CVE-2026-65313?

Andritz HIPASE-250 engineering workstations contain hard-coded VNC credentials that enable any adjacent-network attacker to gain full graphical control over affected systems.

How to fix or mitigate CVE-2026-65313?

Within 24 hours, identify all HIPASE-250 workstations in your environment, confirm their network connectivity, and implement emergency network segmentation to isolate them from untrusted adjacent networks. Within 7 days, disable the x11vnc service on all affected systems and restrict access to engineering networks using firewall rules and VLAN isolation; audit network connectivity from adjacent segments. Within 30 days, develop a remediation plan including either disabling remote access entirely, implementing a secure VNC alternative with certificate-based authentication, or upgrading to a patched version when Andritz releases one.

HIPASE-250 CVE-2026-65313

EUVD-2026-51502 HIGH

Use of Hard-coded Credentials (CWE-798)

2026-07-31 CyberDanube

GHSA-jjwc-g6g3-rhhx

Authentication Bypass Hipase 250 250 Scala Andritz

8.1

CVSS 3.1 · Vendor: CyberDanube

Severity by source

Vendor (CyberDanube) PRIMARY

8.1 HIGH

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

vuln.today AI

8.1 HIGH

Adjacent network required (AV:A), no auth or interaction with a known static password (AC:L/PR:N/UI:N), full desktop control gives high C and I but no direct availability loss (A:N).

3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

4.0 AV:A/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (CyberDanube).

CVSS VectorVendor: CyberDanube

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 31, 2026 - 08:50 vuln.today

CVE Published

Jul 31, 2026 - 07:34 cve.org

HIGH 8.1

DescriptionCVE.org

A provisioning script used when installing HIPASE-250 (formerly 250 SCALA) engineering workstations sets a fixed, hard-coded x11vnc password. Because the same credential is applied to every workstation provisioned this way, an attacker with adjacent-network access who knows the password can gain VNC access to affected workstations.

AnalysisAI

Hard-coded credential exposure in Andritz HIPASE-250 (formerly 250 SCALA) engineering workstations lets an adjacent-network attacker log in over VNC using a fixed x11vnc password baked into the provisioning script. Because every workstation provisioned with that script shares the identical credential, one leaked or reverse-engineered password unlocks remote graphical control of all affected units across a site. Rated CVSS 8.1; no public exploit identified at time of analysis and not listed in CISA KEV.

Technical ContextAI

The affected component is x11vnc, a VNC server that exports an existing X11 display for remote control. During installation, a provisioning script hard-codes the VNC authentication password rather than generating a per-host secret, so the credential is a static value embedded in the deployment tooling. This is a textbook CWE-798 (Use of Hard-coded Credentials) issue: the secret is shared identically across all installations and cannot be assumed private, since anyone with access to the script, an image, or a single device can recover it. The CPE data identifies two labels for the same platform - cpe:2.3:a:andritz:hipase-250 and cpe:2.3:a:andritz:250_scala - indicating a rebranded industrial/OT engineering workstation used to configure Andritz protection and automation equipment.

RemediationAI

No vendor-released patch version is identified at time of analysis, and the only reference is the general vendor site https://www.andritz.com/ - contact Andritz for a security advisory and a corrected provisioning process that generates a unique per-host VNC password. As specific compensating controls: immediately change the x11vnc password on every provisioned workstation to a unique strong value (side effect: any automation or documentation relying on the shared password breaks and must be updated); restrict x11vnc to listen only on localhost or disable the VNC service where remote graphical access is not operationally required (side effect: loss of remote maintenance capability); and enforce network segmentation and firewall rules limiting the VNC port (default 5900) to an isolated management VLAN or jump host, since AV:A means confining the adjacent segment directly cuts off the attack path (side effect: field engineers must route through the approved management path). Prefer tunneling VNC over an authenticated VPN/SSH rather than exposing it on the OT LAN.