These issues, impacting the Energy sector globally, stem from insecure design patterns during development and provisioning. An unauthenticated attacker can gain visibility into live process data, recover credentials, or establish remote control over engineering workstations via VNC. These vulnerabilities highlight the risk of exposed ICS management interfaces and the necessity for robust authentication and secure credential management within operational technology (OT) environments. ANDRITZ has released versions V8.00.00 and V8.15.00 to mitigate these risks.

Impact

Successful exploitation of these vulnerabilities allows for unauthorized access to process values, potential credential harvesting across the enterprise, and the concealment of malicious activity by disabling system logging. In the context of the Energy sector, these impacts pose significant operational risks, including the potential for unauthorized process manipulation or the compromise of sensitive engineering infrastructure, affecting organizations globally that rely on these ANDRITZ platforms.

Recommendation

• Upgrade all ANDRITZ HIPASE-250 and 250 SCALA instances to version V8.15.00 immediately as specified in the vendor remediation.
• Audit network segmentation to ensure management interfaces for HIPASE-250 and 250 SCALA are not reachable from untrusted or public networks to mitigate the risk of unauthenticated access (CVE-2026-65310).
• Review all engineering workstations for VNC services and change default passwords immediately to address CVE-2026-65313.
• Implement monitoring for unauthorized or anomalous access to configuration endpoints and log-level adjustment endpoints, particularly targeting the specific undocumented interfaces described in CVE-2026-65311.