CVE-2026-65313 — Use of hard-coded VNC credentials in the engineering-workstation provisioning

CVE-2026-65313

Use of hard-coded VNC credentials in the engineering-workstation provisioning PUBLISHED

Description (CNA)

A provisioning script used when installing HIPASE-250 (formerly 250 SCALA) engineering workstations sets a fixed, hard-coded x11vnc password. Because the same credential is applied to every workstation provisioned this way, an attacker with adjacent-network access who knows the password can gain VNC access to affected workstations.

Affected (CNA)

Vendor / product	Versions
ANDRITZ / HIPASE-250	affected 0 through 7.20; unaffected 8.15
ANDRITZ / 250 SCALA	affected 0 through 7.20; unaffected 8.15

CWE

CWE-798, CWE-1392

References

https://www.andritz.com/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.