CVE-2025-64121

CRITICAL
2026-01-02 [email protected]
9.8
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

2
Analysis Generated
Mar 12, 2026 - 21:54 vuln.today
CVE Published
Jan 02, 2026 - 22:15 nvd
CRITICAL 9.8

Tags

Authentication Bypass Nplatform

Description

Authentication Bypass Using an Alternate Path or Channel vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Authentication Bypass.This issue affects Multi-Stack Controller (MSC): from 2.3.8 before 2.5.1.

Analysis

Nuvation Energy Multi-Stack Controller (MSC) for battery storage systems allows authentication bypass through an alternate channel, enabling unauthenticated attackers to access critical energy management functions. Affects versions 2.3.8 to 2.5.1.

Technical Context

The Multi-Stack Controller has an alternate authentication path (CWE-288) that bypasses the primary authentication mechanism. This provides unauthenticated access to battery management functions on industrial energy storage systems.

Affected Products

Nuvation Energy Multi-Stack Controller (MSC) 2.3.8 to before 2.5.1

Remediation

Update to MSC firmware 2.5.1 or later. Isolate energy management controllers on dedicated OT networks. Implement network monitoring for unauthorized access attempts.

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: +0.1
CVSS: +49
POC: 0

Share

CVE-2025-64121 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy