CVE-2026-8072: Insecure generation of SAT access credentials in Ingecon EMS Board

Severity: critical (CVSS 9.2 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-12 · updated 2026-10-26
Weakness: CWE-327

Description

Insecure generation of credentials in the local SAT (Technical Support) access functionality of the Ingecon Sun EMS Board. The vulnerability arose because the secret access credentials were not based on a secure cryptographic scheme, but rather on a weak hashing algorithm, which could allow an attacker to carry out a privilege escalation.

Affected products

Ingeteam Ingecon Sun EMS Board: through AAX1055CT; through ABU1001_P; through ACL1201_B; through ACL1200AL; through ABH1027_K; through ABH1007_Z

References

https://www.incibe.es/en/incibe-cert/notices/aviso-sci/insecure-generation-sat-access-credentials-ingecon-ems-board
https://www.reversemode.com/2026/05/a-practical-analysis-of-cyber-physical.html

Get alerted when CVE-2026-8072 or the next vulnerability affects your stack