Andritz
Monthly
Hard-coded credential exposure in Andritz HIPASE-250 (formerly 250 SCALA) engineering workstations lets an adjacent-network attacker log in over VNC using a fixed x11vnc password baked into the provisioning script. Because every workstation provisioned with that script shares the identical credential, one leaked or reverse-engineered password unlocks remote graphical control of all affected units across a site. Rated CVSS 8.1; no public exploit identified at time of analysis and not listed in CISA KEV.
Information disclosure in ANDRITZ HIPASE-250 (formerly 250 SCALA) lets any unauthenticated attacker with network reachability query the device's data and configuration endpoint, exposing live process values and full server configuration. The flaw stems from the default configuration shipping with no authentication and permissive CORS on every response, so no credentials or user interaction are required. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Sensitive credential exposure in ANDRITZ HIPASE-250 (formerly 250 SCALA) stems from storing and transmitting user passwords in a reversible format rather than as one-way hashes, letting anyone who can read the credential store or sniff network traffic recover every stored password in cleartext. The flaw affects the HIPASE-250 protection, control and monitoring platform and carries a CVSS 7.5 (confidentiality-only) rating. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; recovered credentials could enable follow-on authenticated access to the device or connected OT systems.
Remote unauthenticated access to an undocumented HTTP endpoint in ANDRITZ HIPASE-250 (formerly 250 SCALA) allows attackers to silently modify the system's audit logging level and destination without credentials. Rooted in CWE-306 (Missing Authentication for Critical Function), this flaw is particularly dangerous in industrial control system contexts where log integrity underpins incident detection and forensic capability - suppressing logs is a classic defense-evasion precursor enabling follow-on attacks to go unrecorded. No active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis, but the trivial attack complexity (AV:N/AC:L/PR:N/UI:N) means any attacker with network reachability can exploit this without tooling.
Hard-coded credential exposure in Andritz HIPASE-250 (formerly 250 SCALA) engineering workstations lets an adjacent-network attacker log in over VNC using a fixed x11vnc password baked into the provisioning script. Because every workstation provisioned with that script shares the identical credential, one leaked or reverse-engineered password unlocks remote graphical control of all affected units across a site. Rated CVSS 8.1; no public exploit identified at time of analysis and not listed in CISA KEV.
Information disclosure in ANDRITZ HIPASE-250 (formerly 250 SCALA) lets any unauthenticated attacker with network reachability query the device's data and configuration endpoint, exposing live process values and full server configuration. The flaw stems from the default configuration shipping with no authentication and permissive CORS on every response, so no credentials or user interaction are required. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV.
Sensitive credential exposure in ANDRITZ HIPASE-250 (formerly 250 SCALA) stems from storing and transmitting user passwords in a reversible format rather than as one-way hashes, letting anyone who can read the credential store or sniff network traffic recover every stored password in cleartext. The flaw affects the HIPASE-250 protection, control and monitoring platform and carries a CVSS 7.5 (confidentiality-only) rating. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV; recovered credentials could enable follow-on authenticated access to the device or connected OT systems.
Remote unauthenticated access to an undocumented HTTP endpoint in ANDRITZ HIPASE-250 (formerly 250 SCALA) allows attackers to silently modify the system's audit logging level and destination without credentials. Rooted in CWE-306 (Missing Authentication for Critical Function), this flaw is particularly dangerous in industrial control system contexts where log integrity underpins incident detection and forensic capability - suppressing logs is a classic defense-evasion precursor enabling follow-on attacks to go unrecorded. No active exploitation (CISA KEV) and no public exploit code have been identified at time of analysis, but the trivial attack complexity (AV:N/AC:L/PR:N/UI:N) means any attacker with network reachability can exploit this without tooling.