PT-2026-1135 · Nuvation Energy · Multi-Stack Controller

Published 2025-01-13 · Updated 2026-01-03 · CVE-2025-64120

Positive Technologies (AI Summary)

CVSS v4.0

9.4

Critical

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/S:P/AU:Y/R:I

Name of the Vulnerable Software and Affected Versions Nuvation Energy Multi-Stack Controller versions 2.3.8 through 2.5.0

Description A flaw exists in Nuvation Energy Multi-Stack Controller that allows for OS Command Injection. This issue could allow an attacker to execute arbitrary commands on the system. The vulnerability grants shell access with minimal authentication, which is particularly critical for energy storage systems.

Recommendations Update to a version later than 2.5.0.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2026-00781

CVE-2025-64120

Affected Products

Multi-Stack Controller

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-64120 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64120 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00781 · Security Note
• https://twitter.com/vuldb/status/2007227697882378731 · Twitter Post
• https://twitter.com/CVEnew/status/2007224009054712295 · Twitter Post
• https://dragos.com/community/advisories/CVE-2025-64119 · Note
• https://t.me/CVEtracker/41303 · Telegram Post
• https://twitter.com/0dayPublishing/status/2007205468406444034 · Twitter Post