{"id":"CVE-2026-65310","aliases":["EUVD-2026-51500","GHSA-7cj5-w2hx-f2wc"],"status":"published","title":"Missing authentication and permissive CORS policy","description":"ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration\nof affected versions, exposes its data and configuration endpoint\nwithout any authentication and permissive CORS on every response. An\nunauthenticated attacker with network access can read live process\nvalues and server configuration.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.005,"percentile":0.4317,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-306","CWE-942"],"published":"2026-07-31T07:26:29Z","modified":"2026-08-28T15:28:32Z","products":[{"vendor":"andritz","product":"250 scala"},{"vendor":"andritz","product":"hipase-250"}],"references":[{"url":"https://www.andritz.com/"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-65310"},{"url":"https://www.andritz.com"},{"url":"https://github.com/advisories/GHSA-7cj5-w2hx-f2wc"}],"sources":{"cve":[{"id":"CVE-2026-65310","title":"Missing authentication and permissive CORS policy","description":"ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration\nof affected versions, exposes its data and configuration endpoint\nwithout any authentication and permissive CORS on every response. An\nunauthenticated attacker with network access can read live process\nvalues and server configuration.","status":"published","published":"2026-07-31T07:26:29.954Z","modified":"2026-07-31T16:34:44.01Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-306","CWE-942"],"updated_at":"2026-11-02T13:37:13.934727Z"}],"euvd":[{"id":"EUVD-2026-51500","description":"ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration\nof affected versions, exposes its data and configuration endpoint\nwithout any authentication and permissive CORS on every response. An\nunauthenticated attacker with network access can read live process\nvalues and server configuration.","status":"published","published":"2026-07-31T07:26:29Z","modified":"2026-07-31T16:34:44Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T18:02:25.522444Z"}],"ghsa":[{"id":"GHSA-7cj5-w2hx-f2wc","title":"ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration\nof affected versions,...","description":"ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration\nof affected versions, exposes its data and configuration endpoint\nwithout any authentication and permissive CORS on every response. An\nunauthenticated attacker with network access can read live process\nvalues and server configuration.","status":"published","published":"2026-07-31T09:31:18Z","modified":"2026-07-31T09:31:30Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-306"],"updated_at":"2026-11-02T15:09:59.725505Z"}],"nvd":[{"id":"CVE-2026-65310","description":"ANDRITZ HIPASE-250 (formerly 250 SCALA), in the default configuration\nof affected versions, exposes its data and configuration endpoint\nwithout any authentication and permissive CORS on every response. An\nunauthenticated attacker with network access can read live process\nvalues and server configuration.","status":"published","published":"2026-07-31T09:16:58.447Z","modified":"2026-08-28T15:28:32.763Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-306","CWE-942"],"updated_at":"2026-11-02T14:12:34.290716Z"}]}}