CVE-2025-9966 - Vulnerability Details - OpenCVE

Improper privilege management vulnerability in Novakon P series allows attackers to gain root privileges if one service is compromized.This issue affects P series: P – V2001.A.C518o2.

Attack Vector Physical

Attack Complexity High

Privileges Required High

Attack Requirements Present

User Interaction Active

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact High

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact High

Subsequent System Availability Impact High

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Novakon	P Series

No data.

No data.

References

Link	Providers
https://cyberdanube.com/security-research/multiple-vulnerabilities-in-novakon-hmi-series/

History

Thu, 25 Sep 2025 08:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		Novakon Novakon p Series
Vendors & Products		Novakon Novakon p Series

Tue, 23 Sep 2025 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Tue, 23 Sep 2025 11:45:00 +0000

Type	Values Removed	Values Added
Description		Improper privilege management vulnerability in Novakon P series allows attackers to gain root privileges if one service is compromized.This issue affects P series: P – V2001.A.C518o2.
Title		Execution with Unnecessary Privileges
Weaknesses		CWE-269
References		https://cyberdanube.com/security-research/multiple-vulnerabilities-in-novakon-hmi-series/
Metrics		cvssV4_0 `{'score': 7.3, 'vector': 'CVSS:4.0/AV:P/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H'}`

MITRE

Status: PUBLISHED

Assigner: CyberDanube

Published: 2025-09-23T11:41:19.444Z

Updated: 2025-09-23T19:22:06.125Z

Reserved: 2025-09-03T20:34:20.515Z

Link: CVE-2025-9966

Vulnrichment

Updated: 2025-09-23T19:21:57.627Z

NVD

Status : Awaiting Analysis

Published: 2025-09-23T12:15:29.943

Modified: 2025-09-24T18:11:24.520

Link: CVE-2025-9966

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-9966", "assignerOrgId": "7d092a75-6bbd-48c6-a15a-0297458009bc", "state": "PUBLISHED", "assignerShortName": "CyberDanube", "dateReserved": "2025-09-03T20:34:20.515Z", "datePublished": "2025-09-23T11:41:19.444Z", "dateUpdated": "2025-09-23T19:22:06.125Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "platforms": ["Linux"], "product": "P series", "vendor": "Novakon", "versions": [{"status": "affected", "version": "P \u2013 V2001.A.c518o2", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "S. Dietz (CyberDanube)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper privilege management vulnerability in Novakon P series allows attackers to gain root privileges if one service is compromized.<p>This issue affects P series: P \u2013 V2001.A.C518o2.</p>"}], "value": "Improper privilege management vulnerability in Novakon P series allows attackers to gain root privileges if one service is compromized.This issue affects P series: P \u2013 V2001.A.C518o2."}], "impacts": [{"capecId": "CAPEC-69", "descriptions": [{"lang": "en", "value": "CAPEC-69 Target Programs with Elevated Privileges"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "PHYSICAL", "baseScore": 7.3, "baseSeverity": "HIGH", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:P/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "7d092a75-6bbd-48c6-a15a-0297458009bc", "shortName": "CyberDanube", "dateUpdated": "2025-09-23T11:41:19.444Z"}, "references": [{"url": "https://cyberdanube.com/security-research/multiple-vulnerabilities-in-novakon-hmi-series/"}], "source": {"discovery": "EXTERNAL"}, "title": "Execution with Unnecessary Privileges", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-23T19:21:46.495803Z", "id": "CVE-2025-9966", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-23T19:22:06.125Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9966", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-23T19:21:46.495803Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-23T19:21:57.627Z"}}], "cna": {"title": "Execution with Unnecessary Privileges", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "S. Dietz (CyberDanube)"}], "impacts": [{"capecId": "CAPEC-69", "descriptions": [{"lang": "en", "value": "CAPEC-69 Target Programs with Elevated Privileges"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.3, "Automatable": "NOT_DEFINED", "attackVector": "PHYSICAL", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:P/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "providerUrgency": "NOT_DEFINED", "userInteraction": "ACTIVE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Novakon", "product": "P series", "versions": [{"status": "affected", "version": "P \u2013 V2001.A.c518o2", "versionType": "custom"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}], "references": [{"url": "https://cyberdanube.com/security-research/multiple-vulnerabilities-in-novakon-hmi-series/"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper privilege management vulnerability in Novakon P series allows attackers to gain root privileges if one service is compromized.This issue affects P series: P \u2013 V2001.A.C518o2.", "supportingMedia": [{"type": "text/html", "value": "Improper privilege management vulnerability in Novakon P series allows attackers to gain root privileges if one service is compromized.<p>This issue affects P series: P \u2013 V2001.A.C518o2.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-269", "description": "CWE-269 Improper Privilege Management"}]}], "providerMetadata": {"orgId": "7d092a75-6bbd-48c6-a15a-0297458009bc", "shortName": "CyberDanube", "dateUpdated": "2025-09-23T11:41:19.444Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9966", "state": "PUBLISHED", "dateUpdated": "2025-09-23T19:22:06.125Z", "dateReserved": "2025-09-03T20:34:20.515Z", "assignerOrgId": "7d092a75-6bbd-48c6-a15a-0297458009bc", "datePublished": "2025-09-23T11:41:19.444Z", "assignerShortName": "CyberDanube"}, "dataVersion": "5.1"}