{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-8072", "assignerOrgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "state": "PUBLISHED", "assignerShortName": "INCIBE", "dateReserved": "2026-05-07T09:46:15.152Z", "datePublished": "2026-05-12T09:57:02.625Z", "dateUpdated": "2026-05-12T12:19:29.775Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "0cbda920-cd7f-484a-8e76-bf7f4b7f4516", "shortName": "INCIBE", "dateUpdated": "2026-05-12T09:57:02.625Z" }, "title": "Insecure generation of SAT access credentials in Ingecon EMS Board", "datePublic": "2026-05-12T09:47:00.000Z", "problemTypes": [ { "descriptions": [ { "lang": "en", "cweId": "CWE-327", "description": "CWE-327: Use of a Broken or Risky Cryptographic Algorithm", "type": "CWE" } ] } ], "affected": [ { "vendor": "Ingeteam", "product": "Ingecon Sun EMS Board", "versions": [ { "status": "affected", "version": "0", "lessThanOrEqual": "AAX1055CT", "versionType": "custom" }, { "status": "affected", "version": "0", "lessThanOrEqual": "ABU1001_P", "versionType": "custom" }, { "status": "affected", "version": "0", "lessThanOrEqual": "ACL1201_B", "versionType": "custom" }, { "status": "affected", "version": "0", "lessThanOrEqual": "ACL1200AL", "versionType": "custom" }, { "status": "affected", "version": "0", "lessThanOrEqual": "ABH1027_K", "versionType": "custom" }, { "status": "affected", "version": "0", "lessThanOrEqual": "ABH1007_Z", "versionType": "custom" }, { "status": "affected", "version": "0", "lessThanOrEqual": "ABS1009_L", "versionType": "custom" }, { "status": "affected", "version": "0", "lessThanOrEqual": "ABS1005_T", "versionType": "custom" }, { "status": "affected", "version": "0", "lessThanOrEqual": "ACB1005_A", "versionType": "custom" }, { "status": "affected", "version": "0", "lessThanOrEqual": "AAX1031CN", "versionType": "custom" }, { "status": "unaffected", "version": "AAX1055CU" }, { "status": "unaffected", "version": "ABU1001_Q" }, { "status": "unaffected", "version": "ACL1201_C" }, { "status": "unaffected", "version": "ACL1200AM" }, { "status": "unaffected", "version": "ABH1027_L" }, { "status": "unaffected", "version": "ABH1007AA" }, { "status": "unaffected", "version": "ABS1009_P" }, { "status": "unaffected", "version": "ABS1005_U" }, { "status": "unaffected", "version": "ACB1005_C" }, { "status": "unaffected", "version": "AAX1031CO" } ], "defaultStatus": "unaffected" } ], "cpeApplicability": [ { "operator": "OR", "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:a:ingeteam:ingecon_sun_ems_board:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndIncluding": "aax1055ct" }, { "vulnerable": true, "criteria": "cpe:2.3:a:ingeteam:ingecon_sun_ems_board:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndIncluding": "abu1001_p" }, { "vulnerable": true, "criteria": "cpe:2.3:a:ingeteam:ingecon_sun_ems_board:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndIncluding": "acl1201_b" }, { "vulnerable": true, "criteria": "cpe:2.3:a:ingeteam:ingecon_sun_ems_board:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndIncluding": "acl1200al" }, { "vulnerable": true, "criteria": "cpe:2.3:a:ingeteam:ingecon_sun_ems_board:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndIncluding": "abh1027_k" }, { "vulnerable": true, "criteria": "cpe:2.3:a:ingeteam:ingecon_sun_ems_board:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndIncluding": "abh1007_z" }, { "vulnerable": true, "criteria": "cpe:2.3:a:ingeteam:ingecon_sun_ems_board:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndIncluding": "abs1009_l" }, { "vulnerable": true, "criteria": "cpe:2.3:a:ingeteam:ingecon_sun_ems_board:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndIncluding": "abs1005_t" }, { "vulnerable": true, "criteria": "cpe:2.3:a:ingeteam:ingecon_sun_ems_board:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndIncluding": "acb1005_a" }, { "vulnerable": true, "criteria": "cpe:2.3:a:ingeteam:ingecon_sun_ems_board:*:*:*:*:*:*:*:*", "versionStartIncluding": "0", "versionEndIncluding": "aax1031cn" }, { "vulnerable": false, "criteria": "cpe:2.3:a:ingeteam:ingecon_sun_ems_board:aax1055cu:*:*:*:*:*:*:*" }, { "vulnerable": false, "criteria": "cpe:2.3:a:ingeteam:ingecon_sun_ems_board:abu1001_q:*:*:*:*:*:*:*" }, { "vulnerable": false, "criteria": "cpe:2.3:a:ingeteam:ingecon_sun_ems_board:acl1201_c:*:*:*:*:*:*:*" }, { "vulnerable": false, "criteria": "cpe:2.3:a:ingeteam:ingecon_sun_ems_board:acl1200am:*:*:*:*:*:*:*" }, { "vulnerable": false, "criteria": "cpe:2.3:a:ingeteam:ingecon_sun_ems_board:abh1027_l:*:*:*:*:*:*:*" }, { "vulnerable": false, "criteria": "cpe:2.3:a:ingeteam:ingecon_sun_ems_board:abh1007aa:*:*:*:*:*:*:*" }, { "vulnerable": false, "criteria": "cpe:2.3:a:ingeteam:ingecon_sun_ems_board:abs1009_p:*:*:*:*:*:*:*" }, { "vulnerable": false, "criteria": "cpe:2.3:a:ingeteam:ingecon_sun_ems_board:abs1005_u:*:*:*:*:*:*:*" }, { "vulnerable": false, "criteria": "cpe:2.3:a:ingeteam:ingecon_sun_ems_board:acb1005_c:*:*:*:*:*:*:*" }, { "vulnerable": false, "criteria": "cpe:2.3:a:ingeteam:ingecon_sun_ems_board:aax1031co:*:*:*:*:*:*:*" } ] } ] } ], "descriptions": [ { "lang": "en", "value": "Insecure generation of credentials in the local SAT (Technical Support) access functionality of the Ingecon Sun EMS Board. The vulnerability arose because the secret access credentials were not based on a secure cryptographic scheme, but rather on a weak hashing algorithm, which could allow an attacker to carry out a privilege escalation.", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "Insecure generation of credentials in the local SAT (Technical Support) access functionality of the Ingecon Sun EMS Board. The vulnerability arose because the secret access credentials were not based on a secure cryptographic scheme, but rather on a weak hashing algorithm, which could allow an attacker to carry out a privilege escalation." } ] } ], "references": [ { "url": "https://www.incibe.es/en/incibe-cert/notices/aviso-sci/insecure-generation-sat-access-credentials-ingecon-ems-board", "tags": [ "patch" ] }, { "url": "https://www.reversemode.com/2026/05/a-practical-analysis-of-cyber-physical.html" } ], "metrics": [ { "format": "CVSS", "scenarios": [ { "lang": "en", "value": "GENERAL" } ], "cvssV4_0": { "attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "CRITICAL", "baseScore": 9.2, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N" } } ], "solutions": [ { "lang": "en", "value": "The risk has been mitigated with the release of a patch applicable to all versions, developed in December 2025. It is recommended that users update to the newer versions.", "supportingMedia": [ { "type": "text/html", "base64": false, "value": "The risk has been mitigated with the release of a patch applicable to all versions, developed in December 2025. It is recommended that users update to the newer versions." } ] } ], "credits": [ { "lang": "en", "value": "Rubén Santamarta", "type": "finder" } ], "source": { "discovery": "EXTERNAL" }, "x_generator": { "engine": "Vulnogram 1.0.2" } }, "adp": [ { "metrics": [ { "other": { "type": "ssvc", "content": { "timestamp": "2026-05-12T12:14:40.942716Z", "id": "CVE-2026-8072", "options": [ { "Exploitation": "none" }, { "Automatable": "yes" }, { "Technical Impact": "total" } ], "role": "CISA Coordinator", "version": "2.0.3" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-12T12:19:29.775Z" } } ] } }