Unpatched Vulnerabilities Expose Novakon HMIs to Remote Hacking

Unpatched vulnerabilities in Novakon’s HMIs could enable remote hacking, with researchers finding five flaw types in the vendor’s industrial‑control products. According to CyberDanube’s advisory, the issues include an unauthenticated buffer overflow that could allow remote code execution with root privileges, a directory traversal exposing files, and weak authentication problems that grant access to devices and applications.

The security firm’s analysis also notes missing protection mechanisms and unnecessarily high permissions for certain processes, and security researcher Dietz said the vulnerabilities can be exploited remotely without authentication. CyberDanube has said it informed Novakon, but the vendor did not provide feedback and has not released patches, while SecurityWeek notes the company has not commented.

Novakon designs HMIs, industrial PCs and IIoT solutions and serves 18 countries across North America, Europe and Asia, with marketing materials indicating about 40,000 units of its 7” HMIs deployed in global data centers. The article was published on 19 September 2025.