CVE-2026-65310

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-65310", "assignerOrgId": "7d092a75-6bbd-48c6-a15a-0297458009bc", "state": "PUBLISHED", "assignerShortName": "CyberDanube", "dateReserved": "2026-07-21T20:33:52.962Z", "datePublished": "2026-07-31T07:26:29.954Z", "dateUpdated": "2026-07-31T16:34:44.010Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "7d092a75-6bbd-48c6-a15a-0297458009bc", "shortName": "CyberDanube", "dateUpdated": "2026-07-31T07:26:55.686Z"}, "title": "Missing authentication and permissive CORS policy", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-306", "description": "CWE-306 Missing authentication for critical function", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "cweId": "CWE-942", "description": "CWE-942 Permissive cross-domain security policy with untrusted domains", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-36", "descriptions": [{"lang": "en", "value": "CAPEC-36 Using Unpublished Interfaces or Functionality"}]}], "affected": [{"vendor": "ANDRITZ", "product": "HIPASE-250", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "7.20", "versionType": "custom"}, {"status": "unaffected", "version": "7.40"}], "defaultStatus": "affected"}, {"vendor": "ANDRITZ", "product": "250 SCALA", "versions": [{"status": "affected", "version": "0", "lessThanOrEqual": "7.20", "versionType": "custom"}, {"status": "unaffected", "version": "7.40"}], "defaultStatus": "affected"}], "descriptions": [{"lang": "en", "value": "ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration\nof affected versions, exposes its data and configuration endpoint\nwithout any authentication and permissive CORS on every response. An\nunauthenticated attacker with network access can read live process\nvalues and server configuration.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>&nbsp;ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration\nof affected versions, exposes its data and configuration endpoint\nwithout any authentication and permissive CORS on every response. An\nunauthenticated attacker with network access can read live process\nvalues and server configuration.</p>"}]}], "references": [{"url": "https://www.andritz.com/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "HIGH", "baseScore": 7.5, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}}], "credits": [{"lang": "en", "value": "Duc Anh Nguyen (NTCS OT Penetration Testing Team)", "type": "finder"}, {"lang": "en", "value": "Ta Duc Thien (NTCS OT Penetration Testing Team)", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.4"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-31T16:34:22.818330Z", "id": "CVE-2026-65310", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-31T16:34:44.010Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-65310", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-31T16:34:22.818330Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-31T16:34:32.086Z"}}], "cna": {"title": "Missing authentication and permissive CORS policy", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Duc Anh Nguyen (NTCS OT Penetration Testing Team)"}, {"lang": "en", "type": "finder", "value": "Ta Duc Thien (NTCS OT Penetration Testing Team)"}], "impacts": [{"capecId": "CAPEC-36", "descriptions": [{"lang": "en", "value": "CAPEC-36 Using Unpublished Interfaces or Functionality"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "ANDRITZ", "product": "HIPASE-250", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "7.20"}, {"status": "unaffected", "version": "7.40"}], "defaultStatus": "affected"}, {"vendor": "ANDRITZ", "product": "250 SCALA", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "7.20"}, {"status": "unaffected", "version": "7.40"}], "defaultStatus": "affected"}], "references": [{"url": "https://www.andritz.com/"}], "x_generator": {"engine": "Vulnogram 1.0.4"}, "descriptions": [{"lang": "en", "value": "ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration\nof affected versions, exposes its data and configuration endpoint\nwithout any authentication and permissive CORS on every response. An\nunauthenticated attacker with network access can read live process\nvalues and server configuration.", "supportingMedia": [{"type": "text/html", "value": "<p>&nbsp;ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration\nof affected versions, exposes its data and configuration endpoint\nwithout any authentication and permissive CORS on every response. An\nunauthenticated attacker with network access can read live process\nvalues and server configuration.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306 Missing authentication for critical function"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-942", "description": "CWE-942 Permissive cross-domain security policy with untrusted domains"}]}], "providerMetadata": {"orgId": "7d092a75-6bbd-48c6-a15a-0297458009bc", "shortName": "CyberDanube", "dateUpdated": "2026-07-31T07:26:55.686Z"}}}, "cveMetadata": {"cveId": "CVE-2026-65310", "state": "PUBLISHED", "dateUpdated": "2026-07-31T16:34:44.010Z", "dateReserved": "2026-07-21T20:33:52.962Z", "assignerOrgId": "7d092a75-6bbd-48c6-a15a-0297458009bc", "datePublished": "2026-07-31T07:26:29.954Z", "assignerShortName": "CyberDanube"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "affected", "product": "HIPASE-250", "vendor": "ANDRITZ", "versions": [{"lessThanOrEqual": "7.20", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "7.40"}]}, {"defaultStatus": "affected", "product": "250 SCALA", "vendor": "ANDRITZ", "versions": [{"lessThanOrEqual": "7.20", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "7.40"}]}], "source": "office@cyberdanube.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration\nof affected versions, exposes its data and configuration endpoint\nwithout any authentication and permissive CORS on every response. An\nunauthenticated attacker with network access can read live process\nvalues and server configuration."}], "id": "CVE-2026-65310", "lastModified": "2026-08-28T15:28:32.763", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "office@cyberdanube.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-65310", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-31T16:34:22.818330Z", "version": "2.0.3"}}]}, "published": "2026-07-31T09:16:58.447", "references": [{"source": "office@cyberdanube.com", "url": "https://www.andritz.com/"}], "sourceIdentifier": "office@cyberdanube.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}, {"lang": "en", "value": "CWE-942"}], "source": "office@cyberdanube.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,7.20]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "7.40"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "250 SCALA", "source": "cna", "vendor": "ANDRITZ"}, "product": "250_scala", "vendor": "andritz"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,7.20]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "7.40"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "HIPASE-250", "source": "cna", "vendor": "ANDRITZ"}, "product": "hipase-250", "vendor": "andritz"}], "created": "2026-08-02T20:33:06.141013+00:00", "updated": "2026-08-03T10:00:12.448721+00:00", "vendors": ["andritz", "andritz$PRODUCT$250_scala", "andritz$PRODUCT$hipase-250"]}