Vulnerabilidades de ANDRITZ
CVEs publicadas que afetam produtos de ANDRITZ: 4 registro(s), com severidade, exploração e correções.
CVE-2026-65313
Alta · 8.1
CWE-798 31/07/2026
Use of hard-coded VNC credentials in the engineering-workstation provisioning
A provisioning script used when installing HIPASE-250 (formerly 250
SCALA) engineering workstations sets a fixed, hard-coded x11vnc
password. Because the same credential is applied to every workstation
provisioned this way, an attacker with adjacent-network access who
knows the password can gain VNC access to affected workstations.
CVE-2026-65311
Média · 5.3
CWE-284 31/07/2026
Missing authentication for logging-configuration endpoint
The HTTP server component of ANDRITZ HIPASE-250 (formerly 250 SCALA)
in affected versions exposes an undocumented endpoint that changes
the server's logging level and target without requiring
authentication. A remote, unauthenticated attacker with network
access to the service may suppress audit logging, potentially
concealing other activity on the system.
CVE-2026-65310
Alta · 7.5
CWE-306 31/07/2026
Missing authentication and permissive CORS policy
ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration
of affected versions, exposes its data and configuration endpoint
without any authentication and permissive CORS on every response. An
unauthenticated attacker with network access can read live process
values and server configuration.
CVE-2026-65309
Alta · 7.5
CWE-257 31/07/2026
Storage of passwords in a reversible format
ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions stores
and transmits user passwords using a reversible format instead of a
one-way password hash. This allows an attacker able to read the
credential store or capture network traffic to recover all stored
passwords.