ANDRITZ HIPASE-250 shipped with plaintext passwords, hard-coded keys
Four CVEs in ANDRITZ HIPASE-250 require no exploit chain, just network access to a product deployed across energy facilities worldwide.
TL;DR
CISA disclosed four vulnerabilities in ANDRITZ HIPASE-250 and 250 SCALA versions 7.20 and earlier, with CVSS scores reaching 8.7. The flaws let attackers recover plaintext-stored passwords, read live process data from an unauthenticated endpoint, suppress audit logging without credentials, and gain VNC access through a hard-coded provisioning password. Every engineering workstation got the same one. ANDRITZ fixed all four in v8.15.00, released July 2026. No exploit chain is needed; just network access to energy OT software that should never have shipped with these failures.
The four CVEs CISA published Wednesday for ANDRITZ HIPASE-250 and 250 SCALA are individually unremarkable: plaintext password storage, an unauthenticated data endpoint, an undocumented logging-control function, and a hard-coded VNC password in a provisioning script. Collectively they're a portrait of OT software that shipped without security fundamentals, deployed across energy facilities worldwide.
Each vulnerability can be exploited by an attacker who has network access, nothing more. CVE-2026-65309 stores and transmits user passwords in a reversible format, so anyone who reads the credential store or captures network traffic recovers every password. CVE-2026-65310 exposes the data and configuration endpoint without authentication, with permissive CORS on every response. An unauthenticated attacker reads live process values and server configuration directly. CVE-2026-65311 is an undocumented HTTP endpoint that changes logging level and target without credentials, letting an attacker suppress audit trails to conceal other activity. CVE-2026-65313 is the hard-coded x11vnc password set by the provisioning script: same credential on every engineering workstation, VNC access to anyone who knows it.
ANDRITZ published fixes in v8.00.00 in December 2024 and again in v8.15.00 in July 2026. CISA's advisory directs users to the latest version and recommends standard ICS defensive measures: isolate control system networks, minimize internet exposure, use VPNs when remote access is required.
For the practitioner, Monday's question is whether the upgrade from v7.20 to v8.15.00 can happen without operational downtime. The advisory doesn't say. Operators of fielded SCADA deployments should confirm with ANDRITZ directly.
Published ·Deep Fathom