CISA published ICS advisory ICSA-26-225-05 on August 13, 2026, disclosing four vulnerabilities in ANDRITZ HIPASE-250 and 250 SCALA, a SCADA and automation platform deployed at hydropower plants worldwide. ANDRITZ, headquartered in Austria, markets HIPASE-250 as a control-room and plant-wide SCADA layer that scales from individual turbine controllers up to centralized hydropower control rooms, handling generator monitoring, turbine governor integration, and synchronization functions. 250 SCALA is the platform’s former product name; the advisory covers both under a single set of CVEs since they refer to the same codebase.
All four vulnerabilities affect HIPASE-250 and 250 SCALA versions 7.20 and earlier. ANDRITZ has shipped fixes in version V8.00.00 (released December 2024) and V8.15.00 (released July 2026), and recommends all customers move to the latest release. The vulnerabilities were reported to CISA by Duc Anh Nguyen and Ta Duc Thien of the NTCS OT Penetration Testing Team. CISA states no known public exploitation has been reported at this time.
The Four Vulnerabilities
CVE-2026-65309 — Storing Passwords in a Recoverable Format (CWE-257). HIPASE-250 stores and transmits user passwords in a reversible format rather than a one-way hash. An attacker who reads the credential store or captures network traffic can recover all stored passwords in plaintext. CVSS v3.1 base score 7.5 (High), vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N; CVSS v4.0 score 8.7 (High).
CVE-2026-65310 — Missing Authentication for Critical Function (CWE-306). In its default configuration, HIPASE-250 exposes a data and configuration endpoint with no authentication and permissive CORS headers on every response. An unauthenticated attacker with network access can read live process values and server configuration directly — no credentials or session tokens required. This is the most operationally dangerous of the four: it hands an unauthenticated network observer a live read of plant process data. CVSS v3.1 7.5 (High); CVSS v4.0 8.7 (High).
CVE-2026-65311 — Missing Authentication for Critical Function (CWE-306). The HTTP server component exposes an undocumented endpoint that changes the server’s logging level and target without requiring authentication. A remote, unauthenticated attacker can use this to suppress audit logging, which is significant less for direct impact and more for what it enables afterward — an attacker who first mutes logging via this endpoint can then pursue further access with reduced chance of detection. CVSS v3.1 5.3 (Medium); CVSS v4.0 6.9 (Medium).
CVE-2026-65313 — Use of Hard-coded Credentials (CWE-798). A provisioning script used when installing HIPASE-250 engineering workstations sets a fixed, hard-coded password for x11vnc. Because the same credential is baked into every workstation provisioned this way, an attacker with adjacent-network access who knows (or obtains) the password gains VNC access to affected engineering workstations — full remote desktop control, not just data read access. This is the highest-severity finding in the set: CVSS v3.1 8.1 (High), vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N; CVSS v4.0 8.6 (High).
Why the Combination Matters
Individually, several of these findings look like configuration hygiene issues. Together, they form a workable attack chain. An attacker who reaches the network segment hosting HIPASE-250 can pull process data and configuration from the unauthenticated endpoint (CVE-2026-65310) without needing valid credentials at all. If credentials are needed for a next step, the reversible password storage (CVE-2026-65309) means any credential-store or packet-capture access converts directly into plaintext logins rather than hashes requiring cracking. The logging-suppression endpoint (CVE-2026-65311) gives an attacker a way to quiet the audit trail before further activity. And the hard-coded x11vnc password (CVE-2026-65313) provides a standing, fleet-wide backdoor into engineering workstations — the machines used to configure turbine governors, protection settings, and synchronization parameters — that persists across every workstation provisioned from the same install script until it is manually rotated or the workstation is reprovisioned on a patched release.
None of the four requires exploitation of memory corruption or complex logic flaws; all are architectural authentication and credential-handling failures reachable by anyone with network-layer access to the SCADA segment. That places the emphasis for defenders squarely on network segmentation rather than on patch timing alone, since patching removes the design flaw but does not retroactively rotate credentials or invalidate prior unauthorized access.
Recommended Actions
Upgrade to V8.15.00. ANDRITZ has fixed all four issues in the current release; version 7.20 and earlier remain exposed to all of them.
Rotate the x11vnc credential fleet-wide. Because CVE-2026-65313 stems from a provisioning script rather than a per-device unique credential, upgrading alone does not guarantee the old hard-coded password stops working on workstations provisioned before the fix — engineering teams should explicitly verify and rotate VNC credentials on every HIPASE-250 workstation image.
Restrict network reachability to the HIPASE-250 data/config endpoint and HTTP server. Given CVE-2026-65310 and CVE-2026-65311 require no authentication, network-level access control is the only mitigation until every deployed instance is patched. Firewall SCADA-segment access to known engineering and control-room hosts; do not expose these endpoints on any network reachable from IT or business systems.
Force credential rotation after upgrade. Since passwords may have been stored in recoverable form and potentially exposed via network capture (CVE-2026-65309), treat all HIPASE-250 user credentials as potentially compromised and rotate them as part of the upgrade, not just the software version.
Audit logs for gaps. Because CVE-2026-65311 allowed unauthenticated suppression of audit logging, hydropower operators running affected versions should review historical logging continuity for unexplained gaps that could indicate the endpoint was used.
Organizations running HIPASE-250 or 250 SCALA should treat this as a full architectural review of the SCADA segment’s network exposure, not a routine patch-and-close advisory, given how directly the four findings chain into one another.