vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2025-9964

Weak Authentication for Root User

HIGH
8.6
CVSS Score
Published: September 23, 2025 at 11:33 AM UTC
Updated: September 26, 2026 at 12:27 AM UTC
1 product affected across 1 vendorP Series

Using P series by Novakon?

Get instant alerts when new vulnerabilities affect P series - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH8.6
Exploit prediction
EPSS 0.2%
SSVC
No known exploit

Description

No password for the root user is set in Novakon P series. This allows phyiscal attackers to enter the console easily. This issue affects P series: P – V2001.A.C518o2.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

P Series· Novakon
60%
P – V2001.A.c518o2 ≤ v ≤ P-V2005P – V2001.A.c518o2

References (4)

Source: cverecord
https://cyberdanube.com/security-research/multiple-vulnerabilities-in-novakon-hmi-series/
Vendor Advisory
Source: cverecord
https://www.novakon.com.tw/en/news/detail/Security_Advisory__Firmware_Update_Available_for_NOVAKON_P_Series_HMI_Products
Vendor Advisory
Source: cverecord
https://www.novakon.com.tw/common/frontend/download?path=/uploads/images/support/download/NOVAKON_P-Series-HMI_Security-Advisory_CVE-2025-9962-9966_Rev2_0.pdf
Source: af854a3a-2127-422b-91ae-364da2661108
http://seclists.org/fulldisclosure/2025/Sep/70

SSVC — Action Prioritization

SSVCNo known exploitNot automatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

8.6HIGHCyberDanube
Vector?

Quick Info

StatusDEFERRED
CWE
CWE-521

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card