PT-2026-1134 · Nuvation · Nuvation Battery Management System

Published 2025-01-13 · Updated 2026-01-03 · CVE-2025-64119

Positive Technologies (AI Summary)

CVSS v4.0

9.3

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/S:P/AU:Y

Name of the Vulnerable Software and Affected Versions Nuvation Battery Management System versions through 2.3.9

Description A flaw exists in the Nuvation Battery Management System that permits authentication bypass. This allows unauthorized access to critical battery management functions via the network.

Recommendations Versions prior to 2.3.9 should be updated.

Fix

Insufficiently Protected Credentials

OS Command Injection

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-441

CWE-522

CWE-603

CWE-78

CWE-288

Related Identifiers

BDU:2026-00777

BDU:2026-00778

BDU:2026-00779

BDU:2026-00780

BDU:2026-00781

CVE-2025-64119

Affected Products

Nuvation Battery Management System

References · 14

• https://bdu.fstec.ru/vul/2026-00779 · Security Note
• https://bdu.fstec.ru/vul/2026-00778 · Security Note
• https://bdu.fstec.ru/vul/2026-00777 · Security Note
• https://bdu.fstec.ru/vul/2026-00780 · Security Note
• https://bdu.fstec.ru/vul/2026-00781 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-64119 · Security Note
• https://t.me/cveNotify/147638 · Telegram Post
• https://twitter.com/CVEnew/status/2007224009943838920 · Twitter Post
• https://t.me/CVEtracker/41302 · Telegram Post
• https://t.me/cveNotify/147636 · Telegram Post
• https://dragos.com/community/advisories/CVE-2025-64119 · Note
• https://twitter.com/VulmonFeeds/status/2007290749499371646 · Twitter Post
• https://twitter.com/0dayPublishing/status/2007205469299843213 · Twitter Post
• https://t.me/cveNotify/147637 · Telegram Post