The HTTP server of ANDRITZ HIPASE‑250 (formerly 250 SCALA) contains an undocumented endpoint that allows an attacker to alter the logging level and target without authentication. This flaw, represented by CWE‑284, CWE‑306, and CWE‑532, lets a remote attacker suppress audit logging and thereby conceal other malicious activity, reducing system visibility and facilitating further compromise.

ANDRITZ HIPASE‑250 and the legacy 250 SCALA products are affected. The vulnerability exists in all currently supported versions of the HTTP server component, as no specific version ranges are listed.

The CVSS score of 5.3 indicates moderate severity, but the EPSS score of less than 1% shows that exploitation is believed to be unlikely. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires network access to the HTTP service and can be performed by an unauthenticated attacker simply by sending a request to the undocumented endpoint. While it does not provide code execution, it permits an attacker to obscure their actions by disabling audit logs, thus escalating the risk of remaining undetected.