CVE-2025-64121

The vulnerability is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and consists of the ability to access protected resources or system functions through an alternative communication path or channel that does not require proper authentication. A remote attacker, without any privileges or user interaction, can bypass standard access control mechanisms built into the MSC controller. The exploit does not require specific network conditions or prior privileges.

An unauthenticated remote attacker gains full access to the MSC controller, which can lead to device takeover, manipulation of battery energy storage management system configurations, and potentially disruption of energy infrastructure operations. The vulnerability affects the confidentiality, integrity, and availability of the system and related components.

Update Nuvation Energy Multi-Stack Controller (MSC) software to version 2.5.1 or later. Detailed information regarding the update is available in the manufacturer's advisory and in the Dragos references at https://www.dragos.com/community/advisories/CVE-2025-64119. Until the patch is applied, it is recommended to isolate MSC devices from public networks and restrict network access only to trusted hosts.

Nuvation Energy Multi-Stack Controller (MSC) versions from 2.3.8 to 2.5.1 (exclusive), including products: nPlatform, NuvMSC3-04S-C, NuvMSC3-08S-C, NuvMSC3-12S-C, NuvMSC3-16S-C.