High · 8.7 CVE-2025-64124 EUVD-2026-0768GHSA-9fpm-5f3v-gxp2

Nuvation Energy Multi-Stack Controller OS Command Injection

Published Jan 3, 2026 · Updated Jan 5, 2026 · Assigned by Dragos

Vendor: Nuvation Energy Product: Multi-Stack Controller (MSC)

Description

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows OS Command Injection.This issue affects Multi-Stack Controller (MSC): before 2.5.1.

Affected products

Vendor	Product	Affected	Fixed
Nuvation Energy	Multi-Stack Controller (MSC)	< 2.5.1	2.5.1

References

https://www.dragos.com/community/advisories/CVE-2025-64119