Critical · 10.0 CVE-2025-64121 EUVD-2025-206225GHSA-fwx4-5874-4gvg

Nuvation Energy Multi-Stack Controller Authentication Bypass

Published Jan 2, 2026 · Updated Jan 5, 2026 · Assigned by Dragos

Vendor: Nuvation Energy Product: Multi-Stack Controller (MSC)

Description

Authentication Bypass Using an Alternate Path or Channel vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Authentication Bypass.This issue affects Multi-Stack Controller (MSC): from 2.3.8 before 2.5.1.

Affected products

Vendor	Product	Affected	Fixed
Nuvation Energy	Multi-Stack Controller (MSC)	2.3.8 – < 2.5.1	2.5.1

References

https://www.dragos.com/community/advisories/CVE-2025-64119