The Ingecon Sun EMS Board generates local SAT access credentials using a weak hash instead of a secure cryptographic algorithm. This flaw allows an attacker who can reach the SAT interface to infer the secret credentials and gain privileged control over the board, potentially compromising the entire energy management system.

Ingeteam’s Ingecon Sun EMS Board, including models aax1031co, aax1055cu, abh1007aa, abh1027_l, abs1005_u, abs1009_p, abu1001_q, acb1005_c, acl1200am, and acl1201_c, across all versions since the vulnerability exists in the base firmware.

With a CVSS score of 9.2, this vulnerability is considered Critical. The EPSS score is not available, and it is not currently listed in the CISA KEV catalog. The likely attack vector is local access to the SAT interface; once the weak credentials are derived, the attacker can escape to higher privilege levels and potentially disrupt or manipulate EMS operations.