CVE-2025-64123
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2Description
Unintended Proxy or Intermediary vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Network Boundary Bridging.This issue affects Multi-Stack Controller (MSC): through and including release 2.5.1.
Analysis
Nuvation Energy MSC through 2.5.1 can be used as an unintended network proxy to bridge security boundaries. An attacker can leverage the controller to access networks that should be isolated, turning the battery controller into a pivot point.
Technical Context
The Multi-Stack Controller contains an unintended proxy/intermediary vulnerability (CWE-441) that allows network traffic to be forwarded through the device. In energy infrastructure where IT and OT networks are supposed to be segmented, this effectively bridges the air gap.
Affected Products
Nuvation Energy Multi-Stack Controller through 2.5.1 (no patch for this specific issue as of advisory)
Remediation
Implement additional network segmentation that does not rely on the MSC as a boundary. Add firewall rules blocking unexpected traffic patterns from the MSC. Monitor MSC network traffic for anomalous connections.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today