Latest Cybersecurity News, page 55

CCISA AdvisoriesinSecurity Advisories·Aug 20high

ANDRITZ HIPASE-250 and 250 SCALA Multiple Vulnerabilities Disclosed

CISA and ANDRITZ have disclosed four vulnerabilities affecting ANDRITZ HIPASE-250 and 250 SCALA industrial control system software versions 7.20 and earlier. The flaws span reversible password storage, unauthenticated data exposure, an undocumented logging-level endpoint, and a hard-coded x11vnc password in provisioning scripts. ANDRITZ has released patches in versions V8.00.00 (December 2024) and V8.15.00 (July 2026), urging users to update immediately.

32m

CCISA AdvisoriesinVulnerability·Aug 20critical

Critical OS Command Injection Vulnerability Discovered in Haiwell IoT Cloud HMI Gateway

A critical command injection vulnerability (CVE-2026-19188) has been identified in the Haiwell IoT Cloud HMI Gateway product. The flaw exists in the Net Check feature accessible via the /setting endpoint, where the cmdPing Socket.io event fails to properly sanitize user-supplied input before passing it to the underlying operating system. Successful exploitation may allow an attacker to inject and execute arbitrary OS commands with root privileges. The vulnerability affects Haiwell IoT Cloud HMI Gateway version 3.40.1.12 and earlier. Haiwell has addressed the issue in patch version Scada-v3.50.1.19. The vulnerability has been reported to CISA by Fiqram Akmal. No known public exploitation has been reported to CISA at the time of publication. The vulnerability is classified as critical with CVSS scores of 3.1 and 4.0. Affected sectors include Energy, Critical Manufacturing, and Water and Wastewater.

52m