VNC Access Vulnerability in HIPASE-250 Engineering Workstations from Andritz
CVE-2026-65313

8.1HIGH

Key Information:

Vendor

Andritz

Status
Hipase-250
250 Scala
Vendor
CVE Published:
31 July 2026

What is CVE-2026-65313?

The HIPASE-250 engineering workstations from Andritz contain a significant vulnerability due to a provisioning script that sets a hard-coded x11vnc password. This means that every workstation provisioned via this method shares the same password. An attacker with access to the adjacent network can exploit this vulnerability to gain unauthorized VNC access to these workstations, potentially compromising sensitive data and operational integrity.

Affected Version(s)

250 SCALA 0 <= 7.20

250 SCALA 0 <= 7.20

HIPASE-250 0 <= 7.20

References

https://www.andritz.com/

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Duc Anh Nguyen (NTCS OT Penetration Testing Team)
Ta Duc Thien (NTCS OT Penetration Testing Team)
.