For hydropower operators and the Windows administrators supporting them, the immediate job is to identify where the SCADA server, client software, engineering systems, and remote-access components actually run. ANDRITZ says HIPASE-250 supports both Windows and Red Hat Enterprise Linux, and can be deployed from individual touch devices through redundant PC and distributed server arrangements. That flexibility means a single “HIPASE version” in an asset inventory may conceal several systems with different access paths and different owners.
CISA says it has no reports of public exploitation specifically targeting these flaws. That should guide prioritization, but it is not a reason to defer the inventory work: one of the disclosed issues describes unauthenticated access to live process information and configuration data, while another concerns a shared VNC credential applied during workstation provisioning.
The exposed endpoint can reveal live process data
The clearest remote exposure issue is CVE-2026-65310. The National Vulnerability Database record, based on information published by CyberDanube, says the default configuration of affected HIPASE-250 and 250 SCALA installations exposes a data and configuration endpoint without authentication and sends permissive cross-origin headers. An unauthenticated party with network access could read live process values and server configuration.
That is more consequential than an ordinary information-disclosure label implies in a control-room setting. Process values can reveal plant operating state, asset naming conventions, alarm behavior, and the structure of a deployment. Server configuration can provide the next clues an intruder needs to map clients, services, and access controls. The disclosed impact is confidentiality rather than direct process manipulation, but it can lower the cost of a later intrusion.
The NVD assigns the issue a CVSS 3.1 score of 7.5, with network reachability, no required privileges, and no user interaction. CISA’s SSVC enrichment labels the vulnerability as having no known exploitation, being automatable, and having partial technical impact. In practical terms, defenders should treat it as an internal-network exposure that becomes substantially more dangerous when the control network is reachable from a corporate segment, jump host, contractor connection, or poorly separated remote-access environment.
ANDRITZ’s product material advertises TLS, role-based access control, single sign-on, smartcard two-factor authentication, and system hardening for HIPASE-250. Those capabilities do not resolve an endpoint whose default behavior is unauthenticated. Administrators should verify the live deployment rather than rely on the platform’s advertised security features or an assumption that an enterprise identity provider sits in front of every service.
A provisioning script creates a shared VNC-access risk
CVE-2026-65313 is the advisory’s highest-scored finding, at CVSS 8.1. According to the NVD record, a provisioning script used for HIPASE-250 engineering workstations sets a fixed x11vnc password; the same credential is used on every workstation provisioned with that script. An attacker on an adjacent network who knows that credential can obtain VNC access to an affected workstation.
This is a workstation-access problem, not merely a weak password policy finding. A shared provisioned credential means the security boundary is no longer unique to the site or the workstation: disclosure, recovery, or reuse of the password potentially applies across machines built from the same process. The NVD rates it as adjacent-network access with no privileges or user interaction required, and CISA’s SSVC data describes the potential technical impact as total.
The record matters especially for environments where the engineering workstation is trusted to change configuration, load project data, or access operational systems. Even when a workstation is not directly responsible for real-time control, it can be the management plane through which a control system is engineered and maintained. The correct remediation scope therefore includes every provisioned engineering workstation, including dormant spares, vendor-support laptops, lab images, and systems kept offline most of the time but occasionally bridged into the operational network.
The reference to x11vnc points toward a Unix-like workstation component, but Windows teams should not write this off as somebody else’s Linux issue. HIPASE-250 deployments can include Windows hosts, remote desktop, thin clients, and distributed servers alongside the engineering stack. A Windows jump server that can reach an affected workstation, or a shared management VLAN that crosses operating-system boundaries, is part of the exposure path.
CISA’s affected range lacks a complete remediation map
CISA’s advisory identifies versions through 7.20 as affected, but it does not state a single upgrade target, publish a vendor bulletin number, or explain whether all four CVEs are resolved by one common release. That omission is important because the CVE records do not point to a uniform unaffected version.
For CVE-2026-65310, the NVD lists version 7.40 as unaffected. For CVE-2026-65313, it lists version 8.15 as unaffected. Both records list HIPASE-250 and 250 SCALA separately, while describing HIPASE-250 as the product formerly called 250 SCALA. The records therefore establish that newer versions have been marked unaffected for those individual vulnerabilities, but they do not establish that upgrading every affected installation to a particular release resolves the entire four-CVE set.
That is the central administrative gap in the public material. A site running 7.20 or earlier should not infer that “7.40” is a universal answer simply because it appears in one CVE record, nor should it assume that 8.15 is operationally compatible with an existing project. Control-system upgrades commonly carry compatibility, redundancy, operator-interface, validation, and maintenance-window consequences. The missing vendor remediation matrix must be obtained before scheduling changes.
The naming transition creates a second inventory trap. ANDRITZ’s own training material refers to HIPASE-250 with SCADA Client V7 as “before: Control Center 250 SCALA,” while the CVE entries list both names. Searches limited to one product label may miss older asset records, installer archives, configuration backups, support contracts, and virtual-machine templates. Asset discovery should use both “HIPASE-250” and “250 SCALA,” including the older “Control Center 250 SCALA” wording.
What administrators should do before changing production systems
CISA’s general guidance is sound: keep industrial-control assets off the public internet, place control and remote systems behind firewalls, isolate them from business networks, and assess operational impact before deploying mitigations. For this advisory, that broad guidance should become a targeted validation exercise.
- Identify every HIPASE-250 and 250 SCALA server, client, engineering workstation, remote desktop host, and virtual-machine image, recording its installed version and its network location.
- Check whether any web-facing data or configuration service is reachable without authentication from corporate networks, jump hosts, VPN-connected devices, contractor networks, or other non-control segments.
- Locate systems provisioned with the affected engineering-workstation process and determine whether x11vnc is installed, running, reachable, or configured with a shared credential.
- Restrict VNC and other remote-administration services to documented management paths, then rotate any credential that may have originated from a standard provisioning script.
- Preserve the existing configuration and establish a tested rollback path before an upgrade, service reconfiguration, or firewall change affects a redundant control-center deployment.
- Obtain a written ANDRITZ remediation statement that maps each of CVE-2026-65309, CVE-2026-65310, CVE-2026-65311, and CVE-2026-65313 to supported fixed versions and any required configuration changes.
The practical priority is access-path reduction
CISA’s advisory groups the four flaws under recoverable password storage, missing authentication for a critical function, and hard-coded credentials. The combination should change how a site triages the matter. The unauthenticated endpoint makes information available to a network attacker; the VNC issue offers a route into a workstation if the adjacent network can be reached; the remaining password-handling findings increase the importance of preventing unauthorized local or remote access to system files and backups.
There is no public exploitation report as of August 13, and CISA does not describe remote control of hydropower equipment through these vulnerabilities. But the affected product is a SCADA control-center system used across hydropower operations, and its engineering workstations are high-trust assets. The first defensible milestone is therefore not an arbitrary patch deadline: it is a verified list of exposed services, provisioned workstations, and version-specific remediation options, followed by isolation of any reachable VNC or unauthenticated data service until ANDRITZ provides a complete fix path.
