What is the CVSS score of CVE-2025-64121?

CVE-2025-64121 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Nplatform are affected by CVE-2025-64121?

CVE-2025-64121 presents critical security risk rated CVSS 9.8. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems.

How to fix or mitigate CVE-2025-64121?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Monitor vendor channels for patch availability.

Nplatform CVE-2025-64121

CRITICAL

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-01-02 ot-cert@dragos.com

Authentication Bypass Nplatform

9.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

CVE Published

Jan 02, 2026 - 22:15 nvd

CRITICAL 9.8

DescriptionCVE.org

Authentication Bypass Using an Alternate Path or Channel vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Authentication Bypass.This issue affects Multi-Stack Controller (MSC): from 2.3.8 before 2.5.1.

AnalysisAI

Nuvation Energy Multi-Stack Controller (MSC) for battery storage systems allows authentication bypass through an alternate channel, enabling unauthenticated attackers to access critical energy management functions. Affects versions 2.3.8 to 2.5.1.

Technical ContextAI

The Multi-Stack Controller has an alternate authentication path (CWE-288) that bypasses the primary authentication mechanism. This provides unauthenticated access to battery management functions on industrial energy storage systems.

RemediationAI

Update to MSC firmware 2.5.1 or later. Isolate energy management controllers on dedicated OT networks. Implement network monitoring for unauthorized access attempts.