Novakon’s P07, P10, P12, and P15 HMIs were named in a set of five vulnerabilities, including one that CyberDanube says could allow unauthenticated remote code execution. NOVAKON has since published a fix: iFACE Designer 2.0.05, which includes P-2.0.05 firmware. Check the device’s installed firmware and update it; until then, keep it off the public Internet and untrusted networks.
Are Novakon HMIs vulnerable to remote hacking?
Some P Series models and firmware versions were affected. CyberDanube disclosed the issues on August 25, 2025, identifying firmware P – V2001.A.c518o2 as vulnerable. Its report says the findings were manually verified on an emulated device using its MEDUSA firmware runtime; that is not evidence of testing on live customer installations. CyberDanube’s disclosure describes five CVEs, but they do not all have the same access requirements or enable the same kind of attack.
NOVAKON’s Rev 2.0 advisory, dated February 9, 2026, names P07, P10, P12, and P15 as affected and says the vulnerabilities are fixed in P-2.0.05. The model alone does not establish whether a particular unit is still vulnerable: identify its installed firmware version and compare it with the vendor’s advisory. NOVAKON’s advisory specifies the corrective release and update routes.
What the five CVEs describe
- CVE-2025-9962: CyberDanube describes an unauthenticated buffer overflow in the Pseriesbiosinterface service on UDP port 60681 that could let a network attacker execute code as root.
- CVE-2025-9963: A directory-traversal issue involving a symlink in the device’s file-explorer workflow could expose or permit modification of system files as root. CyberDanube’s proof scenario requires physical access to prepare removable media and use the HMI workflow; it is not simply an Internet-only attack. NVD describes exposure of the root filesystem and root-permission file modification, and lists affected firmware through P-2.0.05 Build 2026.02.06. NVD’s CVE-2025-9963 record shows a 9.4 Critical CVSS 4.0 score attributed to CyberDanube; NVD says it has not provided its own assessment.
- CVE-2025-9964: CyberDanube reports weak root authentication: someone with console access could log in as root using an empty password.
- CVE-2025-9965: The application-transfer service on UDP port 60681 reportedly permits unauthenticated application upload and download.
- CVE-2025-9966: CyberDanube reports that many processes run with elevated privileges, which could increase the impact if a service is compromised.
The report also notes missing binary protections, including stack canaries, PIE, and RELRO. Those are additional observations, not a sixth CVE in this series.
Recommended Free Tools
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Which Novakon HMI models and software versions are covered?
NOVAKON names P07, P10, P12, and P15 in its P-Series advisory. The corrected software package is iFACE Designer 2.0.05, Build 2026.02.09 (commit 5ce397b9), containing P-2.0.05 firmware, Build 2026.02.06 (commit d0f97fd9). The version CyberDanube identifies as vulnerable is P – V2001.A.c518o2. Use the installed firmware version shown for the device rather than treating the model name or the availability of an update as proof that a unit has—or has not—been patched.
NOVAKON’s security index presents the combined P-Series advisory as 7.3 High for 2026. That index severity and NVD’s 9.4 Critical score for CVE-2025-9963 are different assessments: neither should be read as a single score independently applying to all five CVEs. NOVAKON’s security advisories index lists its advisory.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
How to update Novakon P Series HMI firmware
NOVAKON’s stated remediation is to install iFACE Designer 2.0.05 and apply its included P-2.0.05 firmware to an affected P Series device. The vendor describes two ways to transfer and install the update:
| Route | How it works | Consideration |
|---|---|---|
| iFACE Designer | Install the firmware through iFACE Designer over USB or TCP/IP. | Requires a computer running the vendor software and the chosen connection to the HMI. |
| Removable media | Transfer the firmware file to USB or SD card, then install it directly on the HMI. | Uses removable media and the device’s on-screen installation workflow. |
- Get the release from NOVAKON. Obtain iFACE Designer 2.0.05 and its firmware from the vendor’s advisory or official distribution channel.
- Verify both downloads. Compare the SHA-256 checksums for the installation package and firmware file against the values in NOVAKON’s advisory. Do not rely on a checksum copied from a secondary source.
- Choose a vendor-supported transfer route. Use iFACE Designer over USB or TCP/IP, or place the firmware file on USB or SD card for installation on the HMI.
- Apply P-2.0.05 and confirm the installed version. Follow NOVAKON’s instructions and check the device’s firmware information afterward to establish that the update completed.
For installation details and the official checksum values, consult NOVAKON’s February 9, 2026 advisory. Do not use a legacy firmware downgrade as a substitute for the current security update; NOVAKON discourages downgrades and says they do not remove the need to apply the latest security updates.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
What to do if you cannot update immediately
Until the firmware is updated, follow NOVAKON’s recommendation to keep the HMI in a protected environment. It should not be reachable from the public Internet or untrusted networks; restrict access to trusted internal networks. CyberDanube also recommends limiting network access and disabling Ethernet when PLC communication uses serial ports. These measures reduce exposure while an update is pending, but they are not a replacement for installing the fix. NOVAKON also recommends continuing to use protected, trusted networks after patching.
Quick Recap
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
