Skip to content
OpenAdvisories

Vendor

Nuvation Energy

7 known vulnerabilities.

Nuvation Energy at a glance

Last 12 months
7
Critical · all time
4
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 5 10 December 2025: 0 vulnerabilities Dec 2025 January 2026: 7 vulnerabilities, 4 critical February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202674
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

Multi-Stack Controller (MSC) 5 Battery Management System 1 nCloud VPN Service 1
All Critical High Medium Low Exploited only Public exploit

7 results · Feed

  • High 8.7
    CVE-2025-64124

    Nuvation Energy Multi-Stack Controller OS Command Injection

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows OS Command Injection.This issue affects Multi-Stack Controller (MSC): before 2.5.1.

    Nuvation Energy Multi-Stack Controller (MSC)
  • Critical 9.4
    CVE-2025-64125

    Nuvation Energy nCloud Client-to-Client Communication

    A vulnerability in Nuvation Energy nCloud VPN Service allowed Network Boundary Bridging.This issue affected the nCloud VPN Service and was fixed on 2025-12-1 (December, 2025). End users do not have to take any action to mitigate the issue.

    Nuvation Energy nCloud VPN Service
  • High 7.9
    CVE-2025-64123

    Nuvation Energy Multi-Stack Controller Proxy service allows arbitrary BMS access

    Unintended Proxy or Intermediary vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Network Boundary Bridging.This issue affects Multi-Stack Controller (MSC): through and including release 2.5.1.

    Nuvation Energy Multi-Stack Controller (MSC)
  • High 7.2
    CVE-2025-64122

    Nuvation Energy Multi-Stack Controller Private Key Stored on Device

    Insufficiently Protected Credentials vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Signature Spoofing by Key Theft.This issue affects Multi-Stack Controller (MSC): through 2.5.1.

    Nuvation Energy Multi-Stack Controller (MSC)
  • Critical 10.0
    CVE-2025-64121

    Nuvation Energy Multi-Stack Controller Authentication Bypass

    Authentication Bypass Using an Alternate Path or Channel vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Authentication Bypass.This issue affects Multi-Stack Controller (MSC): from 2.3.8 before 2.5.1.

    Nuvation Energy Multi-Stack Controller (MSC)
  • Critical 9.4
    CVE-2025-64120

    Nuvation Energy Multi-Stack Controller OS Command Injection

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows OS Command Injection.This issue affects Multi-Stack Controller (MSC): from 2.3.8 before 2.5.1.

    Nuvation Energy Multi-Stack Controller (MSC)
  • Critical 9.3
    CVE-2025-64119

    Nuvation Energy BMS Client-side Authentication

    A vulnerability in Nuvation Battery Management System allows Authentication Bypass.This issue affects Battery Management System: through 2.3.9.

    Nuvation Energy Battery Management System