The ANDRITZ HIPASE-250 device is vulnerable to unauthorized remote configuration access due to missing authentication and permissive CORS policies.

The system suffers from missing authentication for critical functions (CWE-306) and a permissive cross-domain security policy (CWE-942). These flaws allow an unauthenticated remote attacker to interact with the device configuration endpoint via cross-origin requests.

The CVSS score of 7.5 reflects the high risk of unauthorized control over industrial infrastructure components. Exploitation could allow an attacker to modify device configurations, potentially leading to operational disruption or complete loss of control over the affected hardware.

Immediate Action: Update the HIPASE-250 or 250 SCALA firmware to version 7.40 or higher immediately.

Proactive Monitoring: Monitor network traffic for unauthorized access attempts directed at device configuration endpoints and check for suspicious cross-origin requests.

Compensating Controls: Isolate the management interface of the device behind a secure VPN or dedicated management network to prevent direct internet exposure.

Public Exploit Available: Unknown

Given the industrial control nature of the affected product, this vulnerability poses a severe operational risk. It is imperative to isolate the devices from untrusted networks and apply the firmware update as soon as possible to enforce authentication and secure cross-domain policies.