Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2026-65310

Missing authentication and permissive CORS policy

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
CyberDanube

Description

ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration of affected versions, exposes its data and configuration endpoint without any authentication and permissive CORS on every response. An unauthenticated attacker with network access can read live process values and server configuration.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

ANDRITZ HIPASE-250

Default version status: affected

  • 0 to ≤ 7.20affected
  • 7.40unaffected

ANDRITZ 250 SCALA

Default version status: affected

  • 0 to ≤ 7.20affected
  • 7.40unaffected

References