# CVE-2026-65309: ANDRITZ HIPASE-250 reversible password storage and transmission

Source: https://junglewise.ai/threats/cve-2026-65309-andritz-hipase-250-reversible-password-storage-and-transmission  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-31. Updated: 2026-07-31  
License: CC BY 4.0 with a link back

CVE-2026-65309 · Severity: high · CVSS 7.5 · Published 2026-07-31

ANDRITZ HIPASE-250 is an automation and control system used in industrial environments like hydropower plants. A security flaw allows user passwords to be stored and sent in a format that can be easily reversed back into plain text. This means an attacker who can access the system's storage or monitor network traffic could steal credentials, potentially leading to unauthorized access and control over critical industrial operations.

Technologies: [ANDRITZ 250 SCALA](https://junglewise.ai/threats/technologies/250-scala), [ANDRITZ HIPASE-250](https://junglewise.ai/threats/technologies/hipase-250). Vendors: [ANDRITZ](https://junglewise.ai/threats/vendors/andritz).

## Quick answers

**Is CVE-2026-65309 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65309 being exploited in the wild.

**How severe is CVE-2026-65309?** High severity, with a CVSS score of 7.5, published 31 July 2026.

**Which products and versions are affected?** ANDRITZ 250 SCALA <= 7.20; ANDRITZ HIPASE-250 <= 7.20.

**Is there a fix for CVE-2026-65309?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-65309 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-65309?** Check whether you run ANDRITZ 250 SCALA or ANDRITZ HIPASE-250 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability stems from the use of reversible password storage (CWE-257) and potentially weak or broken cryptographic algorithms (CWE-327) within the ANDRITZ HIPASE-250 (formerly 250 SCALA) platform. Instead of utilizing industry-standard one-way salted hashes, the system stores and transmits credentials in a format that can be decrypted or reversed. An unauthenticated attacker with network access can capture these credentials via traffic sniffing, or an attacker with file system access can recover them from the credential store. This flaw is present in versions up to and including 7.20; version 7.50 is reported as unaffected.

## Affected products

- ANDRITZ HIPASE-250 <= 7.20
- ANDRITZ 250 SCALA <= 7.20

## Timeline

- 2026-07-31: advisory: NVD publication date
- 2026-07-31: disclosed: Reported by CyberDanube

## References

- [https://www.andritz.com/](https://www.andritz.com/)

## Related threats

- [ANDRITZ HIPASE-250 hard-coded x11vnc password in provisioning script](https://junglewise.ai/threats/cve-2026-65313-andritz-hipase-250-hard-coded-x11vnc-password-in-provisioning)
- [ANDRITZ HIPASE-250 missing authentication for logging configuration](https://junglewise.ai/threats/cve-2026-65311-andritz-hipase-250-missing-authentication-for-logging)
- [ANDRITZ HIPASE-250 missing authentication in data endpoint](https://junglewise.ai/threats/cve-2026-65310-andritz-hipase-250-missing-authentication-in-data-endpoint)