CVE-2025-9964

HIGH

Novakon P series - Info Disclosure

Title source: llm

Description

No password for the root user is set in Novakon P series. This allows phyiscal attackers to enter the console easily. This issue affects P series: P – V2001.A.C518o2 until P-2.0.05 Build 2026.02.06 (commit d0f97fd9).

References (4)

[Vendor Advisory] https://www.novakon.com.tw/en/news/detail/Security_Advisory__Firmware_Update_Available_for_NOVAKON_P_Series_HMI_Products

[Vendor Advisory] https://www.novakon.com.tw/common/frontend/download?path=/uploads/images/support/download/NOVAKON_P-Series-HMI_Security-Advisory_CVE-2025-9962-9966_Rev2_0.pdf

[Various Sources] https://cyberdanube.com/security-research/multiple-vulnerabilities-in-novakon-hmi-series/

[Mailing List] http://seclists.org/fulldisclosure/2025/Sep/70

Scores

CVSS v4 8.6

EPSS 0.0003

EPSS Percentile 8.3%

CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-521

Status published

Products (2)

Novakon/P series P – V2001.A.c518o2

Novakon/P series (P07, P10, P12, P15) P – V2001.A.c518o2 - P-V2005

Published Sep 23, 2025

Tracked Since Feb 18, 2026