External risk intelligence

Nuvation Energy MSC Authentication Bypass Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 10.0)

CVE-2025-64121

The Nuvation Energy Multi-Stack Controller is an industrial energy management appliance. Such devices are commonly deployed as network-accessible gateways or management interfaces for energy storage systems, making them frequently reachable via network connections in operational environments.

Authentication Bypass

Nuvationenergy Nplatform

2.3.8 to before 2.5.1

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Nuvation Energy's Multi-Stack Controller, potentially allowing unauthorized access. This issue affects the system's ability to properly authenticate users, which could have significant implications for the management and security of energy infrastructure. The main concern is to confirm whether this specific technology is in use and assess any potential exposure.

Allows unauthorized system access.
Critical for energy infrastructure security.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker can bypass authentication on the Nuvation Energy Multi-Stack Controller by exploiting a vulnerability that allows them to access the system through an alternate path or channel. This bypass could lead to unauthorized access and control over the energy management system.

Requires no authentication.
Exploits an alternate access path.
Risk of full system compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to bypass authentication on the Nuvation Energy Multi-Stack Controller. When this controller is accessible externally, an attacker could gain unauthorized access, potentially impacting the control and monitoring of energy systems.

Unauthenticated access to the controller.
Exploiting alternate authentication paths.
Unauthorized control or monitoring.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Nuvation Energy Multi-Stack Controller (MSC) is likely managed by an infrastructure or platform team, with the network and security teams responsible for its exposure and access control. Vendor management may also be involved if the MSC is part of a larger integrated solution. The first step is to locate all deployed MSC instances, determine their network reachability and business criticality, identify the specific owner for each instance, and then prioritize remediation efforts.

Identify MSC instances and owners.
Verify network reachability and criticality.
Plan remediation based on assessed risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Nuvation Energy Multi-Stack Controller?

The Multi-Stack Controller (MSC) is an industrial energy management appliance. It functions as a gateway or interface used to coordinate and monitor energy storage systems. These controllers are part of the nPlatform, providing critical control capabilities for managing power infrastructure and energy flow.

What does Authentication Bypass Using an Alternate Path mean for CVE-2025-64121?

This weakness, categorized as CWE-288, means the system contains multiple ways to verify a user's identity, but one of those paths is not properly protected. An attacker can use this unintended channel to enter the system as if they were a legitimate user, completely skipping the standard login process.

How does an attacker trigger this authentication bypass?

The vulnerability allows an unauthenticated user to access the controller by interacting with the alternate, unprotected path. It does not require any existing user credentials or interaction from a legitimate user. The flaw is inherent in how the system handles communication, meaning standard password protections are effectively ignored during this specific interaction.

Is my device at risk based on Halo Surface Signal?

Halo Surface Signal indicates that these controllers are likely deployed as network-accessible gateways, making them frequently reachable via network connections. If your instance is internet-facing or reachable from untrusted network segments, it is considered more susceptible to remote exploitation compared to units strictly isolated within internal management networks.

What steps should I take if I use a Nuvation Energy MSC?

First, inventory your systems to locate all instances running firmware versions 2.3.8 through 2.5.0. Work with your network and security teams to verify the connectivity and criticality of each unit. Prioritize restricting network access to these controllers while coordinating with your vendor contacts to apply the necessary firmware update to reach version 2.5.1 or later.

References

www.dragos.com/community/advisories/CVE-2025-64119

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.