CVE-2026-65310

The EPSS score of 0.00318 will mislead organizations into treating this as a deprioritized medium-severity finding. That calculation is dangerous in industrial environments. This is an unauthenticated information disclosure on the ANDRITZ HIPASE-250 controller — no authentication required, just send a request and receive live process values and configuration data. In IT contexts, config disclosure is inconvenient. In ICS contexts, it's reconnaissance infrastructure. This is exactly the intelligence a patient adversary needs to design targeted follow-on attacks against the physical process, and the EPSS metric cannot price in that adversary-specific value. The permissive CORS header on every response is a specific indicator of development negligence worth isolating. CORS requires explicit configuration — this wasn't accidental. Either it was left permissive for debugging and never hardened, or the vendor lacks a secure development lifecycle that addresses configuration hardening before deployment. Either explanation is unacceptable for equipment controlling industrial processes. What should drive urgency: remediation timelines for ICS firmware routinely stretch to 18 months, requiring scheduled downtime and vendor coordination. A CVSS 7.5 that gets deprioritized will sit in the queue exactly as long as a patient adversary needs to weaponize their follow-on access. By the time you patch this, the adversary may have already used the disclosed process architecture to target downstream equipment that actually matters to operations — and that follow-on exploit won't have a CVE because no one is looking for it. Check your environment for this pattern: unauthenticated API endpoints on industrial controllers with permissive CORS. If found, treat it as active reconnaissance infrastructure and escalate remediation priority regardless of EPSS or CVSS scores. The vulnerability is the door — what's on the other side is the intelligence an adversary uses to decide what to break.

Reviewed through automated stages and approved by a human before publication.