PT-2026-40003 · Ingecon · Sun Ems Board

Rubén Santamarta · Published 2026-05-12 · Updated 2026-05-12 · CVE-2026-8072

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Ingecon Sun EMS Board versions AAX1055CT and earlier Ingecon Sun EMS Board versions ABU1001 P and earlier Ingecon Sun EMS Board versions ACL1201 B and earlier Ingecon Sun EMS Board versions ACL1200AL and earlier Ingecon Sun EMS Board versions ABH1027 K and earlier Ingecon Sun EMS Board versions ABH1007 Z and earlier Ingecon Sun EMS Board versions ABS1009 L and earlier Ingecon Sun EMS Board versions ABS1005 T and earlier Ingecon Sun EMS Board versions ACB1005 A and earlier Ingecon Sun EMS Board versions AAX1031CN and earlier

Description Insecure generation of credentials in the local SAT (Technical Support) access functionality occurs because secret access credentials are based on a weak hashing algorithm rather than a secure cryptographic scheme. This allows an attacker to predict or brute-force credentials, leading to privilege escalation and unauthorized high-privilege access on the device.

Recommendations Upgrade to the versions released on April 28, 2026.

Fix

LPE

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-327

Related Identifiers

CVE-2026-8072

Affected Products

Sun Ems Board

References · 5

• https://incibe.es/en/incibe-cert/notices/aviso-sci/insecure-generation-sat-access-credentials-ingecon-ems-board · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-8072 · Security Note
• https://twitter.com/UpwindMDR/status/2054269001874964871 · Twitter Post
• https://reversemode.com/2026/05/a-practical-analysis-of-cyber-physical.html · Note
• https://t.me/CVEtracker/53491 · Telegram Post