CVE-2025-9966Execution with Unnecessary Privileges
Updated under an hour ago ()
Does this affect you?
It affects Novakon P series (P07, P10, P12, P15). Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
Improper privilege management vulnerability in Novakon P series allows attackers to gain root privileges if one service is compromized.This issue affects P series: P – V2001.A.C518o2 until P-2.0.05 Build 2026.02.06 (commit d0f97fd9).
- CVSS
- 7.3 HIGH (v4.0, CNA)CVSS:4.0/AV:P/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
- Weakness (CWE)
- CWE-269
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- CyberDanube
- NVD analysis
- Deferred
- Record last updated
- Mar 31, 2026
- First seen by InfoSec Signals
- Oct 11, 2026
Affected products
Novakon P series (P07, P10, P12, P15) novakon:p_series_p07_p10_p12_p15 (from the name) | from P – V2001.A.c518o2 through P-V2005 | CNA record |
References
- https://cyberdanube.com/security-research/multiple-vulnerabilities-in-novakon-hmi-series/
- https://www.novakon.com.tw/en/news/detail/Security_Advisory__Firmware_Update_Available_for_NOVAKON_P_Series_HMI_Productsvendor-advisory
- https://www.novakon.com.tw/common/frontend/download?path=/uploads/images/support/download/NOVAKON_P-Series-HMI_Security-Advisory_CVE-2025-9962-9966_Rev2_0.pdfvendor-advisory
- http://seclists.org/fulldisclosure/2025/Sep/70
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.