CVE-2026-65309

Storage of passwords in a reversible format

State: Published
Severity: 7.5 High
Published: Jul 31, 2026
Updated: Jul 31, 2026
Reserved: Jul 21, 2026

Description

ANDRITZ HIPASE-250 (formerly 250 SCALA) in affected versions stores and transmits user passwords using a reversible format instead of a one-way password hash. This allows an attacker able to read the credential store or capture network traffic to recover all stored passwords.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N	CyberDanube

Weaknesses

CWE-327
CWE-257 Storing passwords in a recoverable format

Affected Products

Product	Versions
HIPASE-250ANDRITZ	7.20 and earlierAffected 7.50Not affected
250 SCALAANDRITZ	7.20 and earlierAffected 7.50Not affected

References

https://www.andritz.com/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.