CVE-2026-65311mediumCWE-284CWE-306CWE-532

CVE-2026-65311: falha de média gravidade em ANDRITZ HIPASE-250

Missing authentication for logging-configuration endpoint

Publicada em

Seguir esta CVE+ Monitorar 250 SCALA+ Monitorar HIPASE-250

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.5%
The HTTP server component of ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions exposes an undocumented endpoint that changes the server's logging level and target without requiring authentication. A remote, unauthenticated attacker with network access to the service may suppress audit logging, potentially concealing other activity on the system.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
ANDRITZ · 250 SCALAANDRITZ · HIPASE-250
CVEs relacionadas — ANDRITZ HIPASE-250

No mesmo produto, das mais perigosas para as menos.

CVE-2026-65310HIGHMissing authentication and permissive CORS policyEPSS 0.5%CVE-2026-65313HIGHUse of hard-coded VNC credentials in the engineering-workstation provisioningEPSS 0.3%CVE-2026-65309HIGHStorage of passwords in a reversible formatEPSS 0.2%