Critical 9.2Published May 12, 2026

CVE-2026-8072Insecure generation of SAT access credentials in Ingecon EMS Board

Updated under an hour ago (Oct 27, 2026, 2:50 PM ET)

Does this affect you?

It affects Ingeteam Ingecon Sun EMS Board. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Ingeteam Ingecon Sun EMS Board

Exploited in the last 30 days

Insecure generation of credentials in the local SAT (Technical Support) access functionality of the Ingecon Sun EMS Board. The vulnerability arose because the secret access credentials were not based on a secure cryptographic scheme, but rather on a weak hashing algorithm, which could allow an attacker to carry out a privilege escalation.

CVSS: 9.2 CRITICAL (v4.0, CNA)CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Weakness (CWE): CWE-327
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: INCIBE
NVD analysis: Deferred
Record last updated: May 12, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Ingeteam Ingecon Sun EMS Board ingeteam:ingecon_sun_ems_board (from the name)	through AAX1055CT; through ABU1001_P; through ACL1201_B; through ACL1200AL; through ABH1027_K; through ABH1007_Z; through ABS1009_L; through ABS1005_T; and 12 more ranges	CNA record

References

References

https://www.incibe.es/en/incibe-cert/notices/aviso-sci/insecure-generation-sat-access-credentials-ingecon-ems-board	patch
https://www.reversemode.com/2026/05/a-practical-analysis-of-cyber-physical.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.