Critical · 9.4 CVE-2025-64120 EUVD-2025-206226GHSA-v668-5qxg-qhjh

Nuvation Energy Multi-Stack Controller OS Command Injection

Published Jan 2, 2026 · Updated Jan 5, 2026 · Assigned by Dragos

Vendor: Nuvation Energy Product: Multi-Stack Controller (MSC)

Description

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows OS Command Injection.This issue affects Multi-Stack Controller (MSC): from 2.3.8 before 2.5.1.

Affected products

Vendor	Product	Affected	Fixed
Nuvation Energy	Multi-Stack Controller (MSC)	2.3.8 – < 2.5.1	2.5.1

References

https://www.dragos.com/community/advisories/CVE-2025-64119