CVE-2025-9964

HighCVSS 8.6

Published: 23/09/2025(UTC)Updated: 26/09/2026(UTC)Translated: 26/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

11th percentile - higher than 11% of all known CVEs

Summary

Novakon P series devices do not have a password set for the root user. A physically present attacker can easily log in to the device console.

Risk Assessment

An attacker with physical access can take control of the device and the network it is connected to. The risk is especially high in public or poorly secured locations.

Recommendation

Set a strong password for the root account and restrict physical access to the device. Update the software to a version newer than P-2.0.05 Build 2026.02.06.

Other vulnerabilities in Novakon P series

CVE-2025-9962Critical
A buffer overflow vulnerability in Novakon P series allows attackers to gain root permission without prior authentication. This affects P series versions from P – V2001.A.C518o2 up to P-2.0.05 Build 2026.02.06 (commit d0f97fd9).

Original NVD description (English source)

No password for the root user is set in Novakon P series. This allows phyiscal attackers to enter the console easily. This issue affects P series: P – V2001.A.C518o2 until P-2.0.05 Build 2026.02.06 (commit d0f97fd9).

Vulnerability data from NVD (NIST) · CISA KEV · EPSS