CVE-2025-64124CWE-78command-injection

CVE-2025-64124

High · published January 3, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
62.8
In the wild
Unconfirmed
What it is

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows OS Command Injection.This issue affects Multi-Stack Controller (MSC): before 2.5.1.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.01010 · 62.8th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2026-01-03T06:15Z
Affected products (1)
ProductVersionsFixed in
nuvationenergy/nplatform≤ 2.5.1—
References (1)
https://www.dragos.com/community/advisories/CVE-2025-64119 · [email protected]
EPSS history
Timeline
  • 03 JAN 00:28Z
    Nuvation Energy Multi-Stack Controller OS Command Injection
    cvelistv5