The HTTP server component of ANDRITZ HIPASE-250 exposes an undocumented endpoint that permits changing the server's logging level and target without authentication. This missing authentication (CWE-306) enables a remote attacker with network access to suppress audit logs, which may conceal other malicious activities on the system. The vulnerability is identified as CVE-2026-65311 with a CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). There is no known patch or remediation level provided by the vendor, and no known exploits in the wild have been reported.

An unauthenticated remote attacker can suppress audit logging by changing the logging configuration, potentially concealing unauthorized or malicious activities. This impacts the integrity of the system's audit logs but does not affect confidentiality or availability. The ability to tamper with logs can hinder incident detection and response.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the HTTP server component to trusted users only to reduce exposure. Monitor for unusual changes in logging behavior if possible.