CVE-2026-65309 in 250 SCALA
Summary
by MITRE • 07/31/2026
ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions stores and transmits user passwords using a reversible format instead of a one-way password hash. This allows an attacker able to read the credential store or capture network traffic to recover all stored passwords.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/31/2026
The ANDRITZ HIPASE-250 system represents a significant security vulnerability through its improper handling of user authentication credentials. This industrial control system, formerly known as 250 SCALA, demonstrates a critical flaw in its credential management architecture where passwords are stored and transmitted using reversible encryption rather than proper one-way hashing mechanisms. The vulnerability stems from the system's failure to implement industry-standard password security practices that are fundamental to protecting user authentication data.
This technical weakness creates a severe operational risk by allowing attackers with access to the credential store or network traffic interception capabilities to directly recover all stored passwords without requiring additional exploitation techniques. The reversible format essentially provides attackers with immediate access to plaintext credentials, eliminating any cryptographic barriers that would typically protect against password recovery attacks. This design flaw violates fundamental security principles and creates an attack surface that can be exploited by both internal and external threat actors with appropriate access levels.
The impact of this vulnerability extends beyond simple credential theft to encompass potential system compromise and operational disruption. When attackers can recover passwords from the credential store, they gain unauthorized access to critical industrial control functions that may include process automation controls, monitoring systems, and administrative interfaces. This scenario directly aligns with attack patterns described in the mitre ATT&CK framework under credential access techniques, specifically targeting the collection of credentials through various means including credential dumping and network traffic interception.
From a compliance perspective, this vulnerability creates significant issues for organizations operating industrial control systems that must adhere to standards such as nist 800-53 and iso/iec 27001. The system's failure to implement proper password hashing mechanisms constitutes a direct violation of security controls related to access control and authentication management. The weakness also impacts the overall security posture by creating a single point of failure where credential compromise can lead to widespread system access and operational disruption.
Organizations should immediately implement mitigations including the replacement of affected systems with versions that properly implement one-way password hashing, deployment of network segmentation to limit access to credential stores, and implementation of additional monitoring for suspicious credential access patterns. The vulnerability demonstrates the critical importance of proper cryptographic implementation in industrial control systems and highlights the need for regular security assessments of operational technology environments to identify similar configuration flaws that could compromise system integrity and operational security.
This issue represents a failure in the principle of least privilege and proper authentication design, as the system architecture does not adequately protect against credential exposure even when access controls are properly implemented. The vulnerability may also impact other security controls such as audit logging and incident response procedures, since compromised credentials can be used to evade detection mechanisms and maintain persistent access to critical systems.