CVE-2025-64123 — Nuvation Energy Multi-Stack Controller Proxy service allows arbitrary BMS access

CVE-2025-64123

Nuvation Energy Multi-Stack Controller Proxy service allows arbitrary BMS access PUBLISHED

Description (CNA)

Unintended Proxy or Intermediary vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Network Boundary Bridging.This issue affects Multi-Stack Controller (MSC): through and including release 2.5.1.

Affected (CNA)

Vendor / product	Versions
Nuvation Energy / Multi-Stack Controller (MSC)	affected 0 through 2.5.1

CWE

CWE-441

References

https://www.dragos.com/community/advisories/CVE-2025-64119

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.