ANDRITZ HIPASE-250 software stores and transmits user passwords in a reversible format instead of a one‑way hash. This design flaw allows an attacker who can read the credential store or capture network traffic to decrypt all stored passwords. The attacker could then gain unauthorized access to the affected devices, potentially leading to full system compromise. The weakness is identified as CWE-257 (Storing passwords in insecure form) and CWE-327 (Use of weak cryptographic algorithm).

The vulnerability affects ANDRITZ HIPASE-250, previously known as 250 SCALA. No specific affected versions are listed in the advisory, so all releases prior to a vendor-specified patch are potentially vulnerable.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of 0.00152 indicates very low but non-zero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is either local access to the credential store or network interception of authentication traffic. An attacker who can read the store or capture traffic would be able to recover all passwords, providing credentials for privileged access to the system.