Hard-Coded VNC Password Among Four ANDRITZ HIPASE-250 Flaws
The vendor fixed all four in v8.00 back in December 2024, but energy-sector operators still running ≤7.20 remain exposed to unauthenticated data access and a shared VNC credential.
TL;DR
CISA published an advisory covering four vulnerabilities in ANDRITZ HIPASE-250 and 250 SCALA versions ≤7.20, deployed widely in the energy sector. CVE-2026-65313 is the most severe, a provisioning script sets a fixed, hard-coded x11vnc password on every engineering workstation, letting an adjacent-network attacker with knowledge of the shared credential gain VNC access (CVSS 8.1). CVE-2026-65310 exposes live process data and server configuration without authentication, CVE-2026-65309 stores passwords in reversible format, and CVE-2026-65311 lets an unauthenticated attacker suppress audit logging. ANDRITZ addressed all four in v8.00, released December 2024.
CISA's advisory covers four distinct weaknesses in the same product line, and the pattern is familiar: defaults that prioritize deployment convenience over security posture, then persist across versions.
CVE-2026-65313 is the one that should get an engineer's attention first. The provisioning script for HIPASE-250 engineering workstations bakes in a static x11vnc password, same credential, every workstation, every installation. An attacker who obtains it (and it's the same everywhere, so obtaining it once compromises every instance) can gain VNC access from an adjacent network with view and control of the desktop. CVE-2026-65310 compounds the exposure: the device's data and configuration endpoint ships with no authentication requirement and permissive CORS headers, meaning anyone on the network can read live process values and server configuration without so much as a login prompt. CVE-2026-65309 means passwords themselves are stored reversibly rather than hashed. CVE-2026-65311 is the stealth vector, an undocumented endpoint lets an unauthenticated remote attacker toggle logging levels and targets, potentially erasing evidence of intrusion.
ANDRITZ fixed all four in v8.00.00, released in December 2024, and reiterated the fix in v8.15.00 in July 2026. That's a 20-month gap between the fix shipping and CISA publishing the advisory. The advisory itself doesn't explain the delay, and CISA notes no known public exploitation has been reported. For operators still on ≤7.20, the remediation path is straightforward: update to v8.15.00. The harder question is whether your asset inventory can tell you which workstations were provisioned with the affected script, the hard-coded VNC credential doesn't go away just because the server was patched.
Published ·Updated ·Deep Fathom