Approved changes feed: RSS · Atom
cpe:2.3:a:andritz:250_scala:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Andritz (592daf48-eeb7-5aec-be84-bdd07202bd0a) |
|---|---|
| Product | 250 Scala (e4276cc8-0902-5acb-a5d5-0df3233248a0) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-65311 |
vulnerable | 2026-09-16 04:33:07.818014 |
Missing authentication for logging-configuration endpoint
MEDIUM (5.3)
The HTTP server component of ANDRITZ HIPASE-250 (formerly 250 SCALA)
in affected versions exposes an undocumented endpoint that changes
the server's logging level and target without requiring
authentication. A remote, unauthenticated attacker with network
access to the service may suppress audit logging, potentially
concealing other activity on the system.
Published: 2026-07-31T07:30:07.250Z
Updated: 2026-07-31T16:33:32.293Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-65309 |
vulnerable | 2026-09-16 04:33:07.803264 |
Storage of passwords in a reversible format
HIGH (7.5)
ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions stores
and transmits user passwords using a reversible format instead of a
one-way password hash. This allows an attacker able to read the
credential store or capture network traffic to recover all stored
passwords.
Published: 2026-07-31T07:17:40.473Z
Updated: 2026-07-31T16:36:34.930Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-65310 |
vulnerable | 2026-09-16 04:33:07.596190 |
Missing authentication and permissive CORS policy
HIGH (7.5)
ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration
of affected versions, exposes its data and configuration endpoint
without any authentication and permissive CORS on every response. An
unauthenticated attacker with network access can read live process
values and server configuration.
Published: 2026-07-31T07:26:29.954Z
Updated: 2026-07-31T16:34:44.010Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-65313 |
vulnerable | 2026-09-16 04:33:07.206867 |
Use of hard-coded VNC credentials in the engineering-workstation provisioning
HIGH (8.1)
A provisioning script used when installing HIPASE-250 (formerly 250
SCALA) engineering workstations sets a fixed, hard-coded x11vnc
password. Because the same credential is applied to every workstation
provisioned this way, an attacker with adjacent-network access who
knows the password can gain VNC access to affected workstations.
Published: 2026-07-31T07:34:11.400Z
Updated: 2026-07-31T16:32:44.345Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.