by Kastro
Paper/Archive/CVE-2026-8072

CVE-2026-8072

Ingeteam Ingecon Sun EMS Board — Insecure generation of SAT access credentials in Ingecon EMS Board

EPSS 0.2%CVSS 9.2
critical.is priorityof 100
29
CVSS 9.2 (CNA)9.2 / 10 × 3027.6Not in CISA KEV+300.0EPSS percentile 4.3.043 × 200.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Insecure generation of credentials in the local SAT (Technical Support) access functionality of the Ingecon Sun EMS Board. The vulnerability arose because the secret access credentials were not based on a secure cryptographic scheme, but rather on a weak hashing algorithm, which could allow an attacker to carry out a privilege escalation.

Affected

ProductAffectedFixed inSource
Ingecon Sun EMS Board≤ AAX1055CTAAX1055CUCNA
Ingecon Sun EMS Board≤ ABU1001_PAAX1055CUCNA
Ingecon Sun EMS Board≤ ACL1201_BAAX1055CUCNA
Ingecon Sun EMS Board≤ ACL1200ALAAX1055CUCNA
Ingecon Sun EMS Board≤ ABH1027_KAAX1055CUCNA
Ingecon Sun EMS Board≤ ABH1007_ZAAX1055CUCNA
Ingecon Sun EMS Board≤ ABS1009_LAAX1055CUCNA
Ingecon Sun EMS Board≤ ABS1005_TAAX1055CUCNA
Ingecon Sun EMS Board≤ ACB1005_AAAX1055CUCNA
Ingecon Sun EMS Board≤ AAX1031CNAAX1055CUCNA

Scores by source

INCIBE (CNA)9.2CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

patchincibe.es/en/incibe-cert/notices/aviso-sci/insecure-generation-sat-access-credentials-ingecon-ems-boardrefreversemode.com/2026/05/a-practical-analysis-of-cyber-physical.html