CVE Intelligence

Nuvation Energy vulnerabilities

🔔 Create alert RSS

Published CVEs affecting Nuvation Energy products: 7 record(s), with severity, exploitation and fixes.

Nplatform 5Multi-Stack Controller (MSC) 5Battery Management System 1nCloud VPN Service 1

Exploited only (KEV) →

CVE-2025-64125 Critical · 9.4 CWE-441 Jan 2, 2026
Nuvation Energy nCloud Client-to-Client Communication
A vulnerability in Nuvation Energy nCloud VPN Service allowed Network Boundary Bridging.This issue affected the nCloud VPN Service and was fixed on 2025-12-1 (December, 2025). End users do not have to take any action to mitigate the issue.
CVE-2025-64124 High · 8.8 CWE-78 Jan 2, 2026
Nuvation Energy Multi-Stack Controller OS Command Injection
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows OS Command Injection.This issue affects Multi-Stack Controller (MSC): before 2.5.1.
CVE-2025-64123 Critical · 9.8 CWE-441 Jan 2, 2026
Nuvation Energy Multi-Stack Controller Proxy service allows arbitrary BMS access
Unintended Proxy or Intermediary vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Network Boundary Bridging.This issue affects Multi-Stack Controller (MSC): through and including release 2.5.1.
CVE-2025-64122 Medium · 5.5 CWE-522 Jan 2, 2026
Nuvation Energy Multi-Stack Controller Private Key Stored on Device
Insufficiently Protected Credentials vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Signature Spoofing by Key Theft.This issue affects Multi-Stack Controller (MSC): through 2.5.1.
CVE-2025-64121 Critical · 9.8 CWE-288 Jan 2, 2026
Nuvation Energy Multi-Stack Controller Authentication Bypass
Authentication Bypass Using an Alternate Path or Channel vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows Authentication Bypass.This issue affects Multi-Stack Controller (MSC): from 2.3.8 before 2.5.1.
CVE-2025-64120 High · 8.8 CWE-78 Jan 2, 2026
Nuvation Energy Multi-Stack Controller OS Command Injection
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows OS Command Injection.This issue affects Multi-Stack Controller (MSC): from 2.3.8 before 2.5.1.
CVE-2025-64119 Critical · 9.3 CWE-603 Jan 2, 2026
Nuvation Energy BMS Client-side Authentication
A vulnerability in Nuvation Battery Management System allows Authentication Bypass.This issue affects Battery Management System: through 2.3.9.