CVE-2026-8072

Insecure generation of credentials in the local SAT (Technical Support) access functionality of the Ingecon Sun EMS Board. The vulnerability arose because the secret access credentials were not based on a secure cryptographic scheme, but rather on a weak hashing algorithm, which could allow an attacker to carry out a privilege escalation.

CVSS

No CVSS.

References

Link	Resource
https://www.incibe.es/en/incibe-cert/notices/aviso-sci/insecure-generation-sat-access-credentials-ingecon-ems-board
https://www.reversemode.com/2026/05/a-practical-analysis-of-cyber-physical.html

Configurations

No configuration.

History

26 Oct 2026, 18:10

Type	Values Removed	Values Added
Summary		(es) Generación insegura de credenciales en la funcionalidad de acceso SAT (Soporte Técnico) local de la placa Ingecon Sun EMS. La vulnerabilidad surgió porque las credenciales de acceso secretas no se basaban en un esquema criptográfico seguro, sino en un algoritmo de hash débil, lo que podría permitir a un atacante llevar a cabo una escalada de privilegios.

Information

Published : 2026-05-12 10:16

Updated : 2026-10-26 18:10

NVD link : CVE-2026-8072

Mitre link : CVE-2026-8072

CVE.ORG link : CVE-2026-8072

JSON object : View

Products Affected

No product.

CWE

CWE-327

Use of a Broken or Risky Cryptographic Algorithm

{"id": "CVE-2026-8072", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8072", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-05-12T12:14:40.942716Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "cve-coordination@incibe.es", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cve-coordination@incibe.es", "affectedData": [{"vendor": "Ingeteam", "product": "Ingecon Sun EMS Board", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "AAX1055CT"}, {"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "ABU1001_P"}, {"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "ACL1201_B"}, {"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "ACL1200AL"}, {"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "ABH1027_K"}, {"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "ABH1007_Z"}, {"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "ABS1009_L"}, {"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "ABS1005_T"}, {"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "ACB1005_A"}, {"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "AAX1031CN"}, {"status": "unaffected", "version": "AAX1055CU"}, {"status": "unaffected", "version": "ABU1001_Q"}, {"status": "unaffected", "version": "ACL1201_C"}, {"status": "unaffected", "version": "ACL1200AM"}, {"status": "unaffected", "version": "ABH1027_L"}, {"status": "unaffected", "version": "ABH1007AA"}, {"status": "unaffected", "version": "ABS1009_P"}, {"status": "unaffected", "version": "ABS1005_U"}, {"status": "unaffected", "version": "ACB1005_C"}, {"status": "unaffected", "version": "AAX1031CO"}], "defaultStatus": "unaffected"}]}], "published": "2026-05-12T10:16:48.670", "references": [{"url": "https://www.incibe.es/en/incibe-cert/notices/aviso-sci/insecure-generation-sat-access-credentials-ingecon-ems-board", "source": "cve-coordination@incibe.es"}, {"url": "https://www.reversemode.com/2026/05/a-practical-analysis-of-cyber-physical.html", "source": "cve-coordination@incibe.es"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cve-coordination@incibe.es", "description": [{"lang": "en", "value": "CWE-327"}]}], "descriptions": [{"lang": "en", "value": "Insecure generation of credentials in the local SAT (Technical Support) access functionality of the Ingecon Sun EMS Board. The vulnerability arose because the secret access credentials were not based on a secure cryptographic scheme, but rather on a weak hashing algorithm, which could allow an attacker to carry out a privilege escalation."}, {"lang": "es", "value": "Generaci\u00f3n insegura de credenciales en la funcionalidad de acceso SAT (Soporte T\u00e9cnico) local de la placa Ingecon Sun EMS. La vulnerabilidad surgi\u00f3 porque las credenciales de acceso secretas no se basaban en un esquema criptogr\u00e1fico seguro, sino en un algoritmo de hash d\u00e9bil, lo que podr\u00eda permitir a un atacante llevar a cabo una escalada de privilegios."}], "lastModified": "2026-10-26T18:10:00.173", "sourceIdentifier": "cve-coordination@incibe.es"}