CVE-2025-64121CWE-288

CVE-2025-64121

Critical · published January 3, 2026

CVSS v3.1
9.8
EPSS
0%
Percentile
32.7
In the wild
Unconfirmed
What it is

Authentication Bypass Using an Alternate Path or Channel vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Authentication Bypass.This issue affects Multi-Stack Controller (MSC): from 2.3.8 before 2.5.1.

The record
Technical detail
CVSS v3.1
9.8 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00397 · 32.7th percentile
Weakness
CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published
2026-01-03T03:15Z
Affected products (1)
ProductVersionsFixed in
nuvationenergy/nplatform≥ 2.3.8, < 2.5.12.5.1
References (1)
https://www.dragos.com/community/advisories/CVE-2025-64119 · [email protected]
EPSS history
Timeline
  • 02 JAN 21:35Z
    Nuvation Energy Multi-Stack Controller Authentication Bypass
    cvelistv5