CVE-2025-64121

CriticalCVSS 9.8/10Last modified Oct 7, 2026

Description

Authentication Bypass Using an Alternate Path or Channel vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Authentication Bypass.This issue affects Multi-Stack Controller (MSC): from 2.3.8 before 2.5.1.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-288

Affected software

Vendor	Product	Versions
Nuvation Energy	Multi-Stack Controller (MSC)	>= 2.3.8, < 2.5.1

References

https://www.dragos.com/community/advisories/CVE-2025-64119Third Party Advisory

Timeline

Published: Jan 2, 2026
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-641225.5Insufficiently Protected Credentials vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Signature Spoofing by Key Theft.Th CVE-2025-641239.8Unintended Proxy or Intermediary vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Network Boundary Bridging.This issue a CVE-2025-641248.8Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Nuvation Energy Multi-Stack Cont CVE-2025-641259.4A vulnerability in Nuvation Energy nCloud VPN Service allowed Network Boundary Bridging.This issue affected the nCloud VPN Service and was f CVE-2025-6412610.0An OS command injection vulnerability exists due to improper input validation. The application accepts a parameter directly from user input CVE-2025-6412710.0An OS command injection vulnerability exists due to insufficient sanitization of user-supplied input. The application accepts parameters t CVE-2025-6412810.0An OS command injection vulnerability exists due to incomplete validation of user-supplied input. Validation fails to enforce sufficient f CVE-2025-641297.6Zenitel TCIV-3+ is vulnerable to an out-of-bounds write vulnerability, which could allow a remote attacker to crash the device.CVE-2025-64138.8A vulnerability classified as critical has been found in PHPGurukul Art Gallery Management System 1.1. This affects an unknown part of the f CVE-2025-641309.8Zenitel TCIV-3+ is vulnerable to a reflected cross-site scripting vulnerability, which could allow a remote attacker to execute arbitrary CVE-2025-641317.5Jenkins SAML Plugin 4.583.vc68232f7018a_ and earlier does not implement a replay cache, allowing attackers able to obtain information about CVE-2025-641325.4Jenkins MCP Server Plugin 0.84.v50ca_24ef83f2 and earlier does not perform permission checks in multiple MCP tools, allowing attackers to tr