CVE-2026-65311

Summary

The HTTP server component of ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions exposes an undocumented endpoint that changes the server's logging level and target without requiring authentication. A remote, unauthenticated attacker with network access to the service may suppress audit logging, potentially concealing other activity on the system.

Affected Software

VendorProductVersion RangeStatus
ANDRITZHIPASE-2500 <= 7.20affected
ANDRITZHIPASE-2508.00unaffected
ANDRITZ250 SCALA0 <= 7.20affected
ANDRITZ250 SCALA8.00unaffected

Weaknesses

  • CWE-306: CWE-306 Missing authentication for critical function
  • CWE-532: CWE-532 Insertion of sensitive information into log file
  • CWE-284: CWE-284

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References