CVE-2026-65310 in HIPASE-250
Summary
by MITRE • 07/31/2026
ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration of affected versions, exposes its data and configuration endpoint without any authentication and permissive CORS on every response. An unauthenticated attacker with network access can read live process values and server configuration.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/31/2026
The ANDRITZ HIPASE-250 system represents a critical industrial control platform that manages process data and operational configurations within manufacturing environments. This vulnerability stems from inadequate security controls in the default configuration of affected software versions, creating an exploitable misconfiguration that fundamentally undermines the system's security posture. The device exposes its data and configuration endpoints through HTTP responses without implementing any form of authentication mechanisms, leaving sensitive operational information accessible to unauthorized parties who can establish network connections to the system.
The technical flaw manifests as a complete absence of access control measures on critical system endpoints, combined with permissive cross-origin resource sharing policies that allow arbitrary domains to interact with the system's APIs. This configuration creates a dangerous combination where both process data and server configuration information becomes immediately available upon request. The CORS policy is configured to accept requests from any origin, eliminating the browser-based security protections that typically prevent cross-site request forgery attacks. This permissive setting effectively removes the boundary protection that should exist between internal industrial systems and external network entities.
The operational impact of this vulnerability extends far beyond simple information disclosure, as it provides attackers with real-time visibility into critical process parameters and system configurations that could be used for further exploitation or targeted attacks against the industrial infrastructure. An unauthenticated attacker can access live process values including temperature readings, pressure measurements, flow rates, and other operational metrics that represent the current state of industrial processes. Additionally, server configuration details expose network settings, user accounts, access controls, and system parameters that could facilitate more sophisticated attack vectors such as privilege escalation or system compromise.
This vulnerability directly maps to CWE-200 (Information Disclosure) and CWE-346 (Origin Validation), while also aligning with ATT&CK techniques related to credential access and reconnaissance. The exposure of live process data creates opportunities for attackers to understand operational patterns, identify system weaknesses, and potentially manipulate industrial processes through data injection or command injection attacks. The lack of authentication mechanisms violates fundamental security principles for industrial control systems and represents a critical failure in defense-in-depth strategies that should protect operational technology environments from external threats.
Organizations should immediately implement network segmentation controls to isolate affected systems from untrusted networks and apply firmware updates that address the authentication and CORS misconfigurations. Access controls must be configured to require proper authentication before exposing any operational data or configuration endpoints, while CORS policies should be restricted to specific trusted domains only. Additionally, security monitoring should be enhanced to detect unauthorized access attempts to sensitive endpoints, and regular security assessments should verify that industrial control systems maintain appropriate access controls in their default configurations. The remediation process should include comprehensive review of all exposed endpoints to ensure that no other similar misconfigurations exist within the operational technology infrastructure.