ANDRITZ relay passwords were stored in reversible form, and the fix shipped in December 2024

ANDRITZ HIPASE-250 protection and control devices, formerly sold as 250 SCALA, store and transmit user passwords in a reversible format instead of a one-way hash, so anyone who can read the credential store or capture network traffic can recover every stored password ^[1]. CISA has now published the advisory, numbered ICSA-26-225-05 ^[12], for a defect the vendor says it fixed in version V8.00.00, released in December 2024 ^[3].

The affected range is HIPASE-250 and 250 SCALA at version 7.20 and below ^[4], deployed worldwide in the energy sector by a vendor headquartered in Austria ^[6]. Four CVEs are listed: CVE-2026-65309, CVE-2026-65310, CVE-2026-65311 and CVE-2026-65313 ^[5]. The advisory does not say which identifier belongs to which defect; it lists all four against both products ^[5].

The password handling is catalogued as CWE-257, storing passwords in a recoverable format ^[2]. That single weakness converts any read access into credential access, and because the passwords also cross the wire in reversible form, a passive listener on an engineering LAN gets the same result as someone with a copy of the credential file ^[1].

The other three findings are the reason this is not a tidy single-issue advisory. In the default configuration, affected versions expose a data and configuration endpoint with no authentication at all, and return permissive CORS headers on every response, so an unauthenticated attacker with network access can read live process values and server configuration ^[8]. The HTTP server also exposes an undocumented endpoint that changes the logging level and target without authentication, which a remote unauthenticated attacker can use to suppress audit logging and conceal other activity ^[9]. Two of the four described defects are missing authentication for a critical function, CWE-306 ^[14]. Separately, a provisioning script used when installing HIPASE-250 engineering workstations sets a fixed, hard-coded x11vnc password, identical on every workstation built that way, giving VNC access to an adjacent-network attacker who knows it ^[10]. CISA sums up the outcome as reading data from the device or gaining access to affected workstations ^[7].

The remediation story is where operators should focus. ANDRITZ addressed the issues in V8.00.00 in December 2024 and again in V8.15.00 in July 2026, and points users to the current release, V8.15.00 ^[3]. That is roughly 19 months between the two remediating versions ^[13]. Anything still running 7.20 or earlier has had a patched branch available for over a year. The vulnerabilities were reported to CISA by Duc Anh Nguyen and Ta Duc Thien of the NTCS OT Penetration Testing Team ^[11].

Three things to check. First, version inventory: 7.20 and below is the whole affected set, so the question is simply which relays never moved to the 8.x branch ^[4]. Second, passwords already in the store were recoverable, so an upgrade alone does not undo prior exposure and every operator credential on an affected device should be treated as known ^[1]. Third, updating software does not rotate a VNC password already written to a workstation by the old provisioning script, so those hosts need the credential changed by hand ^[15].