CVE-2026-65310 Overview
CVE-2026-65310 affects ANDRITZ HIPASE-250 (formerly 250 SCALA) industrial control system devices. The default configuration exposes a data and configuration endpoint without any authentication. Every response also includes permissive Cross-Origin Resource Sharing (CORS) headers. An unauthenticated attacker with network access can read live process values and server configuration directly from the device.
The vulnerability is classified under [CWE-306: Missing Authentication for Critical Function]. It requires no privileges, no user interaction, and can be exploited over the network.
Critical Impact
Any attacker reaching the device network can retrieve real-time process telemetry and full server configuration without credentials, exposing sensitive operational technology (OT) data.
Affected Products
- ANDRITZ HIPASE-250 (formerly 250 SCALA) in default configuration
- Affected firmware versions as identified by the vendor
- Deployments where the data and configuration endpoint is network-reachable
Discovery Timeline
- 2026-07-31 - CVE-2026-65310 published to the National Vulnerability Database (NVD)
- 2026-07-31 - Last updated in NVD database
Technical Details for CVE-2026-65310
Vulnerability Analysis
The ANDRITZ HIPASE-250 device exposes an HTTP endpoint that returns live process values and server configuration data. In the default configuration, this endpoint enforces no authentication. Any client that can reach the device over the network can issue requests and retrieve the responses.
The endpoint additionally returns permissive CORS headers on every response. This allows scripts loaded in a browser from any origin to read the responses. An operator visiting a malicious page from an engineering workstation on the OT network could unknowingly leak device state to a remote attacker.
Exploitation results in disclosure of sensitive OT information, including live process values and configuration parameters that describe the operating environment.
Root Cause
The underlying flaw is missing authentication on a sensitive HTTP interface [CWE-306]. The default configuration ships without access control on the data and configuration endpoint. The permissive CORS policy compounds the exposure by removing browser same-origin protections that would otherwise limit cross-site abuse.
Attack Vector
The attack vector is network-based and requires no authentication or user interaction. An attacker with routed access to the device sends unauthenticated HTTP requests to the exposed endpoint and parses the returned JSON or text payloads. A browser-based variant leverages the permissive CORS headers to exfiltrate data through a victim's browser session on the OT network.
No public proof-of-concept exploit is currently listed for this CVE. See the Andritz Company Website for vendor advisories and technical references.
Detection Methods for CVE-2026-65310
Indicators of Compromise
- Unauthenticated HTTP GET requests to the HIPASE-250 data and configuration endpoint from unexpected source addresses
- HTTP responses from HIPASE-250 devices containing Access-Control-Allow-Origin: * headers to external origins
- Anomalous outbound traffic from engineering workstations to internet destinations shortly after browsing activity
Detection Strategies
- Monitor network flows to and from HIPASE-250 devices and alert on connections originating outside authorized engineering VLANs
- Inspect HTTP request patterns targeting the device management endpoint for high-volume or scripted access
- Correlate browser telemetry from operator workstations with connections to OT device IP addresses
Monitoring Recommendations
- Deploy passive OT network monitoring to baseline normal access to HIPASE-250 endpoints
- Log and retain all HTTP traffic to control system devices for forensic review
- Alert on any external or non-engineering network segment initiating sessions to the device
How to Mitigate CVE-2026-65310
Immediate Actions Required
- Restrict network access to HIPASE-250 devices using firewall rules and network segmentation, allowing only authorized engineering hosts
- Place affected devices behind a jump host or VPN and remove any direct exposure to enterprise or internet networks
- Contact ANDRITZ to confirm the availability of a firmware update or hardened configuration guidance
Patch Information
No specific patch identifier is listed in the enriched CVE record. Consult the Andritz Company Website for the latest firmware releases and security advisories for HIPASE-250 (formerly 250 SCALA). Apply vendor-supplied updates as soon as they become available and validate configuration changes in a test environment before production rollout.
Workarounds
- Enforce strict network segmentation between OT and IT networks using ISA/IEC 62443 zone and conduit principles
- Block inbound HTTP access to the device from all sources except authorized engineering workstations
- Disable or restrict the exposed endpoint if the vendor documents a supported method
- Require operators to use dedicated, hardened workstations that do not permit general internet browsing
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
