CVE Intelligence
Analysis AI-assisted

CVE-2026-8072: Ingecon Sun EMS Board Weak Credential Generation Leading to Privilege Escalation

CVE-2026-8072 affects the local SAT (Technical Support) access function of the Ingecon Sun EMS Board. The secret access credentials were generated with a weak hashing algorithm rather than a secure cryptographic scheme, which could allow privilege escalation. The record provides no affected or fixed versions, and no confirmed exploitation appears in the sources consulted.

Published Oct 13, 2026 · Updated Oct 13, 2026 · Ler em português

Overview

CVE-2026-8072 concerns the local SAT (Technical Support) access function of the Ingecon Sun EMS Board. According to the record, the secret credentials for this access were generated with a weak hashing algorithm instead of a sound cryptographic scheme, classified as CWE-327.

Impact

  • The description states that an attacker could carry out a privilege escalation.
  • The CVSS v4.0 base score of 9.2 (Critical) was assigned by INCIBE. Its vector indicates a network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity and availability of the vulnerable system.

Affected products and versions

  • The product named in the record is the Ingecon Sun EMS Board.
  • The record lists no affected version ranges, so the affected versions are unknown from the data consulted.

Exploitation status

  • The record shows the CVE is not listed in CISA KEV. No active exploitation is confirmed in the sources consulted.
  • The record provides an EPSS probability of 0.00232 and a percentile of 0.12996.

Remediation and mitigation

  • The record lists no fixed version. The absence of this data does not mean no fix exists, so check the INCIBE notice and the vendor for updates.
  • Restrict access to the device's technical support functions to authorized personnel and limit its network exposure.
  • Ask the vendor whether support-access credentials can be rotated or disabled, and follow its guidance.

Detection guidance

  • Review device and access logs for unexpected logins to technical support or administrative functions.
  • Monitor for changes in privileges, new accounts or unexpected configuration changes on the device.

Limitations of the available information

  • Affected versions, fixed versions, vendor patches and details of the hashing scheme are not in the record.
  • The description refers to local SAT access, while the CVSS vector indicates a network attack vector. The reason for this difference is unknown from the record.
  • The second reference is listed without further detail.

Frequently asked questions

Is CVE-2026-8072 known to be exploited in the wild?

The record does not list this CVE in CISA KEV. No confirmed exploitation appears in the sources consulted.

Which Ingecon Sun EMS Board versions are affected?

The record lists no affected versions, so this information is unknown from the data consulted. Check the INCIBE notice and the vendor.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.