PT-2026-1138 · Nuvation Energy · Ncloud Vpn Service+1

Published 2025-01-13 · Updated 2026-01-03 · CVE-2025-64123

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Nuvation Energy Multi-Stack Controller (MSC) versions through 2.5.1 Nuvation Energy nCloud VPN Service (affected versions not specified)

Description An issue involving Network Boundary Bridging exists in Nuvation Energy nCloud VPN Service and Multi-Stack Controller (MSC). This allows for unintended proxy or intermediary behavior. The nCloud VPN Service issue was resolved on December 1, 2025, and no action is required from end users.

Recommendations Versions of Nuvation Energy Multi-Stack Controller (MSC) prior to and including 2.5.1 should be updated. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-441

Related Identifiers

BDU:2026-00780

CVE-2025-64123

Affected Products

Multi-Stack Controller

Ncloud Vpn Service

References · 9

• https://bdu.fstec.ru/vul/2026-00780 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64123 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64123 · Security Note
• https://t.me/CVEtracker/41306 · Telegram Post
• https://twitter.com/vuldb/status/2007224270355869961 · Twitter Post
• https://t.me/cveNotify/147636 · Telegram Post
• https://dragos.com/community/advisories/CVE-2025-64119 · Note
• https://twitter.com/CVEnew/status/2007224006219333823 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2007283069351281079 · Twitter Post