CVE-2025-9964

CVE-2025-9964 affects Novakon P series (P – V2001.A.C518o2). The root cause is an absent/no password for the root user, enabling physical attackers to access the console. CVSS shows a HIGH impact with physical attack vector and no user interaction. The issue is documented across multiple feeds (N...

CVE-2025-9964 Weak Authentication for Root User

No password for the root user is set in Novakon P series. This allows phyiscal attackers to enter the console easily. This issue affects P series: P – V2001.A.C518o2 until P-2.0.05 Build 2026.02.06 commit d0f97fd9...

CVE-2025-9964 Weak Authentication for Root User

No password for the root user is set in Novakon P series. This allows phyiscal attackers to enter the console easily. This issue affects P series: P – V2001.A.C518o2 until P-2.0.05 Build 2026.02.06 commit d0f97fd9...

Novakon P series 安全漏洞

Novakon P series is a series of industrial panel PC operation pages from the Taiwan, China based company Novakon. A security vulnerability exists in the Novakon P series version V2001.A.C518o2, which stems from a failure to set a root user password, which could result in a physical attacker gaini...

CVE-2025-8453

CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation and arbitrary code execution when a privileged engineer user with console access modifies a configuration file used by a root-level daemon to execute custom scripts...

CVE-2025-8453

CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation and arbitrary code execution when a privileged engineer user with console access modifies a configuration file used by a root-level daemon to execute custom scripts...

CVE-2025-8453

CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation and arbitrary code execution when a privileged engineer user with console access modifies a configuration file used by a root-level daemon to execute custom scripts...

CVE-2025-8453

CVE-2025-8453 describes a CWE-269 vulnerability in Schneider Electric Saitel DR RTU (and related RTU products) where a privileged engineer with console access can modify a configuration file used by a root‑level daemon to execute scripts, enabling privilege escalation and potential arbitrary code...

PT-2025-34053 · Unknown · Root-Level Daemon

Name of the Vulnerable Software and Affected Versions: affected versions not specified Description: A CWE-269: Improper Privilege Management issue exists that may lead to privilege escalation and arbitrary code execution. This occurs when a privileged engineer user with console access modifies a...

CVE-2025-42949

Due to a missing authorization check in the ABAP Platform, an authenticated user with elevated privileges could bypass authorization restrictions for common transactions by leveraging the SQL Console. This could enable an attacker to access and read the contents of database tables without proper...

Exposing PathWiper: DCOM Abuse and Network Erasure

Exposing PathWiper: A Deep Dive into DCOM Abuse and Network Erasure With Trellix NDR By Maulik Maheta and Lishoy Mathew · August 12, 2025 Executive summary Ukraine’s national energy and telecommunications infrastructure was the primary targets of the PathWiper attack in 2025. The attack was...

CVE-2025-50124

A CWE-269: Improper Privilege Management vulnerability exists that could cause privilege escalation when the server is accessed by a privileged account via a console and through exploitation of a setup script...

CVE-2023-30354

Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 does not defend against physical access to U-Boot via the UART: the Wi-Fi password is shown, and the hardcoded boot password can be inserted for console access...

CVE-2023-27823

An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the administration console without valid credentials...

CVE-2023-49255

The router console is accessible without authentication at "data" field, and while a user needs to be logged in in order to modify the configuration, the session state is shared. If any other user is currently logged in, the anonymous user can execute commands in the context of the authenticated...

CVE-2021-41554

ARCHIBUS Web Central 21.3.3.815 a version from 2014 does not properly validate requests for access to data and functionality in these affected endpoints: /archibus/schema/ab-edit-users.axvw, /archibus/schema/ab-data-dictionary-table.axvw, /archibus/schema/ab-schema-add-field.axvw,...

CVE-2021-36741

An improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG, and Worry-Free Business Security 10.0 SP1 allows a remote attached to upload arbitrary files on affected installations. Please note: an attacker must first obtain the ability to logon to the...

CVE-2021-31222

SES Evolution before 2.1.0 allows updating some parts of a security policy by leveraging access to a computer having the administration console installed...

CVE-2020-6985

In Moxa PT-7528 series firmware, Version 4.0 or lower, and PT-7828 series firmware, Version 3.9 or lower, these devices use a hard-coded service code for access to the console...

CVE-2019-18189

A directory traversal vulnerability in Trend Micro Apex One, OfficeScan 11.0, XG and Worry-Free Business Security 9.5, 10.0 may allow an attacker to bypass authentication and log on to an affected product's management console as a root user. The vulnerability does not require authentication...