CVE-2026-65309: ANDRITZ HIPASE-250 Password Storage Flaw

CVE-2026-65309 Overview

CVE-2026-65309 affects ANDRITZ HIPASE-250, formerly known as 250 SCALA. The industrial control product stores and transmits user passwords using a reversible format instead of a one-way password hash. Any attacker able to read the credential store or capture network traffic can recover all stored passwords in plaintext. The weakness is classified under CWE-257: Storing Passwords in a Recoverable Format.

Critical Impact
Attackers with read access to the credential store or network traffic can recover every stored user password, enabling account takeover across the affected deployment.

Affected Products

ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions
Specific version ranges are not enumerated in the CVE record
Refer to the Andritz corporate website for vendor advisories

Discovery Timeline

2026-07-31 - CVE CVE-2026-65309 published to NVD
2026-07-31 - Last updated in NVD database

Technical Details for CVE-2026-65309

Vulnerability Analysis

The vulnerability stems from the use of reversible password protection rather than a one-way cryptographic hash. Reversible formats include plaintext storage, symmetric encryption where the key resides on the same system, or encoding schemes such as Base64. Any of these approaches allow an attacker who obtains the ciphertext and associated key material to recover the original credentials.

HIPASE-250 exposes this weakness both at rest, in the credential store, and in transit, on the network. As a result, two independent attack paths lead to full password disclosure. The impact scope is C:H/I:N/A:N, reflecting complete confidentiality loss without direct integrity or availability effects. Recovered passwords, however, can be replayed to authenticate as legitimate users and pivot into engineering, operator, or administrative roles on the industrial system.

Root Cause

The root cause is a design decision to protect passwords with a reversible transformation. Secure password handling requires a salted, computationally expensive one-way hash such as PBKDF2, bcrypt, scrypt, or Argon2. Because HIPASE-250 must be able to read the password back for authentication comparison or transmission, the stored form retains recoverability by design.

Attack Vector

Exploitation requires network access or access to the credential store. An attacker positioned on the operational technology network can capture authentication traffic and reverse the format to obtain credentials. Alternatively, an attacker with file-system or database read access to the credential store can extract and decode the stored passwords offline. No authentication or user interaction is required, and attack complexity is low.

No public proof-of-concept exploit is listed in the CVE record, and the vulnerability is not on the CISA Known Exploited Vulnerabilities list. The EPSS probability is 0.152%.

Detection Methods for CVE-2026-65309

Indicators of Compromise

Unexpected read access to HIPASE-250 configuration files or credential databases from non-administrative accounts
Packet captures containing HIPASE-250 authentication exchanges originating from unexpected hosts
Successful logins to HIPASE-250 accounts from new endpoints or at unusual times following network sniffing activity

Detection Strategies

Monitor OT network segments for unauthorized traffic capture tools and promiscuous-mode interfaces near HIPASE-250 devices
Alert on file-access events targeting the HIPASE-250 credential store outside of scheduled maintenance windows
Correlate authentication anomalies, such as concurrent sessions or geographically implausible logins, with prior network exposure events

Monitoring Recommendations

Enable authentication logging on HIPASE-250 and forward events to a centralized SIEM for correlation
Baseline normal administrative access patterns to the credential store and alert on deviations
Deploy network intrusion detection signatures for known HIPASE-250 authentication protocols to identify replay attempts

How to Mitigate CVE-2026-65309

Immediate Actions Required

Contact ANDRITZ through the Andritz corporate website to obtain the current security advisory and remediation guidance
Segment HIPASE-250 devices onto isolated OT network zones with strict access control lists
Rotate all HIPASE-250 user passwords and assume any historically stored or transmitted passwords are compromised
Restrict read access to the credential store to a minimal set of administrative accounts

Patch Information

The CVE record does not enumerate a specific patched version. Administrators should obtain the fixed release directly from ANDRITZ and confirm that user passwords are stored using a salted one-way hash after upgrade.

Workarounds

Place HIPASE-250 traffic inside an encrypted tunnel, such as an IPsec VPN, to prevent credential capture on the wire
Enforce unique credentials on HIPASE-250 that are not reused on any other system to limit blast radius
Enable multi-factor authentication on upstream jump hosts used to reach HIPASE-250 management interfaces
Continuously monitor for unauthorized access to configuration files containing credentials

bash

# Example: restrict network reachability to HIPASE-250 management interface
# Replace 10.10.20.5 with the device IP and 10.10.99.0/24 with your admin subnet
iptables -A FORWARD -s 10.10.99.0/24 -d 10.10.20.5 -p tcp --dport 443 -j ACCEPT
iptables -A FORWARD -d 10.10.20.5 -j DROP