Cyber Posture

CVE-2025-64121

Critical

Published: 02 January 2026

Published
02 January 2026
Modified
26 February 2026
KEV Added
—
Patch
—
CVSS Score 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0012 30.9th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Description

Authentication Bypass Using an Alternate Path or Channel vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Authentication Bypass.This issue affects Multi-Stack Controller (MSC): from 2.3.8 before 2.5.1.

Mitigating Controls (NIST 800-53 r5)AI

AC-14 Permitted Actions Without Identification or Authentication good match
prevent

Explicitly identifies and restricts actions permitted without identification or authentication, directly mitigating authentication bypass via alternate paths or channels.

AC-3 Access Enforcement good match
prevent

Enforces approved access authorizations across all logical access paths, preventing unauthorized access through alternate unauthenticated channels.

AC-6 Least Privilege partial match
prevent

Limits privileges to the minimum necessary, reducing the impact of successful authentication bypass by restricting unauthorized actions post-access.

Security SummaryAI

CVE-2025-64121 is an Authentication Bypass Using an Alternate Path or Channel vulnerability (CWE-288) in the Nuvation Energy Multi-Stack Controller (MSC). It affects MSC versions from 2.3.8 up to but not including 2.5.1. The vulnerability enables attackers to bypass authentication mechanisms, earning a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity due to its potential for high impact on confidentiality, integrity, and availability.

Remote attackers require no privileges or user interaction to exploit this vulnerability over the network with low complexity. Successful exploitation allows authentication bypass, potentially granting unauthorized access to the MSC device and enabling full control over its functions.

A related advisory is available from Dragos at https://www.dragos.com/community/advisories/CVE-2025-64119, which may provide additional context or mitigation guidance.

Details

CWE(s)
CWE-288

Affected Products

nuvationenergy
nplatform
2.3.8 — 2.5.1

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

The vulnerability is an authentication bypass in a network-accessible service (Nuvation Energy MSC), directly enabling exploitation of a public-facing application for unauthorized remote access and full control.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References