Read the docs
TI-2026-46518 Aliases CVE-2026-65311GHSA-cv9h-3483-8gjq

Missing authentication for logging-configuration endpoint

Priority LOW 30CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass, Information disclosure
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-284 and CWE-532.

Summary

The HTTP server component of ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions exposes an undocumented endpoint that changes the server's logging level and target without requiring authentication. A remote, unauthenticated attacker with network access to the service may suppress audit logging, potentially concealing other activity on the system.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00455 39th percentileScored 2026-11-07
Fix Fixed HIPASE-250 (ANDRITZ): 8.00250 SCALA (ANDRITZ): 8.00

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ANDRITZHIPASE-250up to 7.208.00Patch availableCNA
ANDRITZ250 SCALAup to 7.208.00Patch availableCNA
  • HIPASE-250 VendorANDRITZ Affected up to 7.20 Fixed in 8.00 Patch available CNA
  • 250 SCALA VendorANDRITZ Affected up to 7.20 Fixed in 8.00 Patch available CNA

Remediation

  • Fix · CNA HIPASE-250 (ANDRITZ) Fixed in 8.00
  • Fix · CNA 250 SCALA (ANDRITZ) Fixed in 8.00

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-65311
  2. 2026-10-03 Alias added: GHSA-cv9h-3483-8gjq

References

Other 1

  • TI-2026-46517 Missing authentication and permissive CORS policy CVSS 3.1HIGH 7.5
  • TI-2026-46519 Use of hard-coded VNC credentials in the engineering-workstation provisioning CVSS 3.1HIGH 8.1
  • TI-2026-46516 Storage of passwords in a reversible format CVSS 3.1HIGH 7.5

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences