CVE-2026-65311 Overview
CVE-2026-65311 affects the HTTP server component of ANDRITZ HIPASE-250, formerly known as 250 SCALA. The server exposes an undocumented endpoint that modifies the logging level and target without requiring authentication. A remote, unauthenticated attacker with network access to the service can suppress audit logging on the device. Suppressed logging can conceal other malicious activity performed against the system. The issue maps to CWE-284: Improper Access Control and carries a CVSS 3.1 base score of 5.3.
Critical Impact
Unauthenticated network attackers can disable or redirect audit logging on ANDRITZ HIPASE-250 devices, obscuring follow-on attacker activity and impairing forensic visibility.
Affected Products
- ANDRITZ HIPASE-250 (formerly 250 SCALA)
- HTTP server component of affected HIPASE-250 versions
- Deployments exposing the HIPASE-250 HTTP service to reachable networks
Discovery Timeline
- 2026-07-31 - CVE-2026-65311 published to NVD
- 2026-07-31 - Last updated in NVD database
Technical Details for CVE-2026-65311
Vulnerability Analysis
The HIPASE-250 HTTP server ships with an undocumented endpoint that manipulates runtime logging behavior. The endpoint accepts requests that change the active logging level and the log target destination. No authentication, authorization, or session validation gates this endpoint. As a result, any client with network reachability to the HTTP service can issue configuration changes. Lowering the logging level suppresses audit records for subsequent operations. Redirecting the log target sends records to an attacker-controlled or invalid destination. Both outcomes degrade the integrity of on-device audit trails without affecting confidentiality or availability directly.
Root Cause
The root cause is missing access control on a management endpoint. The HIPASE-250 HTTP server exposes logging configuration through an interface that bypasses the product's authentication layer. The endpoint is not documented in vendor materials, indicating it was likely intended for internal or diagnostic use. Because it is reachable over the network without credentials, it violates the principle of least privilege and secure default configuration.
Attack Vector
Exploitation requires only network access to the HIPASE-250 HTTP service. The attacker sends a crafted HTTP request to the undocumented endpoint to alter the log level or target. No user interaction, prior compromise, or elevated privileges are needed. In operational technology environments where HIPASE-250 devices are reachable from engineering VLANs or misconfigured segments, this reachability requirement is often satisfied. Attackers typically chain this weakness with other actions on objectives, using log suppression to hide command execution, configuration tampering, or lateral movement traces.
No verified proof-of-concept code has been published. See the ANDRITZ corporate website for vendor advisories and product documentation.
Detection Methods for CVE-2026-65311
Indicators of Compromise
- Unexpected changes in HIPASE-250 logging verbosity, such as a shift from informational to error-only levels without an operator change record.
- HTTP requests to undocumented paths on the HIPASE-250 management interface originating from non-engineering hosts.
- Gaps or sudden reductions in audit log volume from HIPASE-250 devices compared to historical baselines.
- Log target reconfigurations pointing to unexpected internal or external syslog destinations.
Detection Strategies
- Baseline normal HTTP request patterns to the HIPASE-250 management interface and alert on requests to non-standard URIs.
- Monitor for abrupt changes in log ingestion rate from each HIPASE-250 device on the SIEM side.
- Correlate any logging-configuration change with an authenticated operator session; unmatched changes indicate exploitation.
Monitoring Recommendations
- Forward HIPASE-250 logs to a centralized SIEM in near real time so on-device suppression does not erase evidence already shipped.
- Enable network-level packet capture or NetFlow on segments hosting HIPASE-250 to reconstruct HTTP traffic if device logs are tampered with.
- Alert on any HTTP POST or PUT to the HIPASE-250 service from sources outside an approved engineering workstation allowlist.
How to Mitigate CVE-2026-65311
Immediate Actions Required
- Restrict network access to the HIPASE-250 HTTP service using firewall rules or ACLs so only authorized engineering hosts can reach it.
- Place HIPASE-250 devices on a segmented OT VLAN with no direct reachability from IT networks or the internet.
- Ship logs off-device continuously to a protected collector so tampering with local logging has limited forensic impact.
- Contact ANDRITZ support for advisory details and available firmware updates for HIPASE-250.
Patch Information
No public patch reference is included in the NVD entry at the time of publication. Refer to the ANDRITZ corporate website for vendor advisories, firmware updates, and remediation guidance specific to affected HIPASE-250 versions.
Workarounds
- Enforce strict network segmentation and deny inbound HTTP to HIPASE-250 from untrusted zones.
- Terminate the HIPASE-250 management interface behind a jump host that enforces authentication and full session logging.
- Deploy an in-line reverse proxy or WAF that blocks requests to undocumented URIs on the HIPASE-250 HTTP service.
- Continuously stream device logs to an external SIEM so suppressed local logs do not eliminate the audit trail.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
