NVD disclosure day
CVE-2025-64121
Halo Surface Signal: 4 out of 5 — likely to be public-facing.
An authentication bypass vulnerability exists in Nuvation Energy Multi-Stack Controller (MSC), allowing unauthenticated access through alternate paths. This could lead to unauthorized control and monitoring of energy systems if the MSC is externally reachable. Confirmation of its use and assessment of exposure are cruc
CVE-2025-64120
Halo Surface Signal: 3 out of 5 — possibly public-facing.
A vulnerability in Nuvation Energy's Multi-Stack Controller allows OS command injection, potentially enabling unauthorized control if reachable. This technology is used in energy management systems, and exploitation could lead to system compromise.
CVE-2025-64119
Halo Surface Signal: 2 out of 5 — less likely to be public-facing.
A vulnerability in the Nuvation Battery Management System allows for authentication bypass, potentially granting unauthorized access to system functions. This critical flaw, if reachable, could permit unauthenticated attackers to gain control over battery management operations. Readers should verify if this system is p
CVE-2025-67268
Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.
A vulnerability exists in gpsd's handling of NMEA2000 packets, allowing an attacker to cause memory corruption via crafted network packets. This could lead to denial of service or potentially arbitrary code execution, impacting systems that rely on gpsd for location data.