CVE-2026-65309 describes a weakness in ANDRITZ HIPASE-250 where user passwords are stored and transmitted in a reversible format instead of a one-way hash. This design flaw (CWE-327 and CWE-257) enables attackers with access to the credential store or network traffic to retrieve plaintext passwords. The vulnerability is network exploitable without privileges or user interaction, impacting confidentiality but not integrity or availability. No affected versions or patches have been explicitly stated, and no known exploits are reported in the wild.

An attacker able to read the credential store or capture network traffic can recover all stored passwords, compromising user credentials and potentially enabling unauthorized access. The confidentiality of user passwords is fully impacted, while integrity and availability remain unaffected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, limit access to the credential store and secure network communications to reduce exposure.