CVE-2026-65313: HIPASE-250 Auth Bypass Vulnerability

CVE-2026-65313 Overview

CVE-2026-65313 is a hard-coded credential vulnerability [CWE-798] affecting Andritz HIPASE-250 engineering workstations, formerly branded as 250 SCALA. A provisioning script used during installation configures x11vnc with a fixed password that is identical across every workstation deployed with the script. An attacker with adjacent-network access who knows or recovers the password can authenticate to the Virtual Network Computing (VNC) service and gain interactive control of the workstation. The workstation role in industrial automation environments makes unauthorized VNC access a direct path to operator interface manipulation.

Critical Impact
Adjacent-network attackers with knowledge of the shared credential can obtain VNC access to any HIPASE-250 workstation provisioned with the affected script, enabling confidentiality and integrity compromise of operator systems.

Affected Products

Andritz HIPASE-250 engineering workstation (formerly 250 SCALA)
Workstations provisioned using the affected installation script
Deployments exposing x11vnc on adjacent network segments

Discovery Timeline

2026-07-31 - CVE-2026-65313 published to the National Vulnerability Database
2026-07-31 - Last updated in NVD database

Technical Details for CVE-2026-65313

Vulnerability Analysis

The vulnerability resides in the provisioning workflow that installs HIPASE-250 engineering workstations. The provisioning script configures x11vnc, a VNC server that shares an existing X11 desktop, with a fixed password baked into the script. Every workstation installed through this process receives the same credential.

Because x11vnc exposes the entire operator desktop, an authenticated VNC session grants full keyboard and mouse control. In industrial engineering workstation contexts, this exposes configuration tooling, human-machine interface (HMI) applications, and connected control-system endpoints. The attack requires network reachability to the VNC port on an affected workstation, typically TCP 5900.

Root Cause

The root cause is Use of Hard-coded Credentials [CWE-798]. The password is embedded in the provisioning script rather than generated per host or prompted during installation. Any party with access to the script, a previously provisioned workstation, or leaked documentation can recover the password and reuse it across the fleet.

Attack Vector

Exploitation requires adjacent-network access such as the same VLAN, plant network segment, or a routed path to the workstation VNC listener. The attacker connects to x11vnc and supplies the shared password. No user interaction on the workstation is required. Once authenticated, the attacker interacts with the desktop session as if physically present. See the Andritz official website for vendor contact information regarding affected deployments.

Vulnerability described in prose only. No verified proof-of-concept code is available at the time of publication.

Detection Methods for CVE-2026-65313

Indicators of Compromise

Unexpected inbound TCP connections to port 5900 on HIPASE-250 workstations from hosts other than sanctioned administrative jump servers.
x11vnc process invocations with parameters referencing the shared password file or -passwd argument outside of scheduled provisioning windows.
Successful VNC authentication events followed by keyboard or mouse input activity during non-operational hours.

Detection Strategies

Inventory all HIPASE-250 workstations and enumerate those provisioned with the affected script by comparing installed x11vnc password hashes.
Baseline legitimate VNC client sources and alert on any deviation, including connections originating from operator or corporate subnets.
Correlate authentication logs from workstations with network flow records to identify lateral VNC access.

Monitoring Recommendations

Enable packet capture or flow monitoring on plant network segments hosting engineering workstations and retain records for retrospective analysis.
Forward workstation host logs, including x11vnc and desktop session events, to a centralized log platform for correlation.
Alert on any process launching x11vnc after initial provisioning is complete, as steady-state operation should not require reconfiguration.

How to Mitigate CVE-2026-65313

Immediate Actions Required

Change the x11vnc password on every HIPASE-250 workstation to a unique, per-host value that is not stored in shared scripts or images.
Restrict TCP 5900 at the network layer to a narrow allowlist of administrative hosts using firewall rules or access-control lists.
Contact Andritz to confirm remediation guidance and obtain any updated provisioning artifacts.

Patch Information

No vendor patch identifier is listed in the NVD record at the time of publication. Refer to the Andritz official website for updated security advisories, revised provisioning scripts, and coordinated remediation instructions.

Workarounds

Disable x11vnc on workstations that do not require remote desktop access and remove it from startup services.
Tunnel required VNC sessions through an authenticated VPN or SSH forwarder rather than exposing the raw VNC listener on the plant network.
Segment engineering workstations onto a dedicated VLAN with strict east-west controls to eliminate adjacent-network reachability from general-purpose hosts.

bash

# Rotate the x11vnc password on an affected workstation
sudo x11vnc -storepasswd "$(openssl rand -base64 24)" /etc/x11vnc.pass
sudo chmod 600 /etc/x11vnc.pass

# Restrict inbound VNC to a trusted admin host (example using iptables)
sudo iptables -A INPUT -p tcp --dport 5900 -s 10.10.20.5 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 5900 -j DROP