CVE-2025-9966
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk27th percentile - higher than 27% of all known CVEs
Summary
Improper privilege management vulnerability in Novakon P series allows attackers to gain root privileges if one service is compromised. Affects versions from P-V2001.A.C518o2 to P-2.0.05 Build 2026.02.06 (commit d0f97fd9).
Risk Assessment
After compromising one service, an attacker could gain full system control, potentially leading to complete device takeover and security breach.
Recommendation
Update to a patched version and reduce attack surface through network segmentation and service monitoring.
Other vulnerabilities in Novakon P series
See all- CVE-2025-9962Critical
A buffer overflow vulnerability in Novakon P series allows attackers to gain root permission without prior authentication. This affects P series versions from P – V2001.A.C518o2 up to P-2.0.05 Build 2026.02.06 (commit d0f97fd9).
- CVE-2025-9964High
Novakon P series devices do not have a password set for the root user. A physically present attacker can easily log in to the device console.
Original NVD description (English source)
Improper privilege management vulnerability in Novakon P series allows attackers to gain root privileges if one service is compromized.This issue affects P series: P – V2001.A.C518o2 until P-2.0.05 Build 2026.02.06 (commit d0f97fd9).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS