# CVE-2025-9964

## Summary

- **CVE ID:** CVE-2025-9964
- **Severity:** HIGH
- **CVSS Score:** 8.6 (CVSS:4.0/AV:P/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H)
- **CWE:** CWE-521
- **Published:** Sep 23, 2025
- **Last Modified:** Mar 31, 2026

## Description

No password for the root user is set in Novakon P series. This allows phyiscal attackers to enter the console easily. 
This issue affects P series: P – V2001.A.C518o2.

## Affected Products

- Novakon — P series (P – V2001.A.c518o2)
- Novakon — P series (P07, P10, P12, P15) (P – V2001.A.c518o2)

## References

- [CNA](https://cyberdanube.com/security-research/multiple-vulnerabilities-in-novakon-hmi-series/)
- [CVE](http://seclists.org/fulldisclosure/2025/Sep/70)
- [CNA](https://www.novakon.com.tw/en/news/detail/Security_Advisory__Firmware_Update_Available_for_NOVAKON_P_Series_HMI_Products)
- [CNA](https://www.novakon.com.tw/common/frontend/download?path=/uploads/images/support/download/NOVAKON_P-Series-HMI_Security-Advisory_CVE-2025-9962-9966_Rev2_0.pdf)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.22%
- **EPSS Percentile:** 12.1

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-10._