CVE-2025-64120

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows OS Command Injection.This issue affects Multi-Stack Controller (MSC): from 2.3.8 before 2.5.1.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.dragos.com/community/advisories/CVE-2025-64119	Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:nuvationenergy:nplatform:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:nuvationenergy:nuvmsc3-04s-c:-:::::::*
	cpe:2.3:h:nuvationenergy:nuvmsc3-08s-c:-:::::::*
	cpe:2.3:h:nuvationenergy:nuvmsc3-12s-c:-:::::::*
	cpe:2.3:h:nuvationenergy:nuvmsc3-16s-c:-:::::::*

History

30 Sep 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de neutralización incorrecta de elementos especiales utilizados en un comando del sistema operativo ('inyección de comandos del SO') en Nuvation Energy Multi-Stack Controller (MSC) permite la inyección de comandos del SO. Este problema afecta a Multi-Stack Controller (MSC): desde 2.3.8 antes de 2.5.1.

Information

Published : 2026-01-02 22:15

Updated : 2026-10-07 11:10

NVD link : CVE-2025-64120

Mitre link : CVE-2025-64120

CVE.ORG link : CVE-2025-64120

JSON object : View

Products Affected

nuvationenergy

nuvmsc3-16s-c
nplatform
nuvmsc3-08s-c
nuvmsc3-04s-c
nuvmsc3-12s-c

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2025-64120", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64120", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-01-05T20:31:27.751445Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "ot-cert@dragos.com", "cvssData": {"Safety": "PRESENT", "version": "4.0", "Recovery": "IRRECOVERABLE", "baseScore": 9.4, "Automatable": "YES", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:Y/R:I/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "ot-cert@dragos.com", "affectedData": [{"vendor": "Nuvation Energy", "product": "Multi-Stack Controller (MSC)", "versions": [{"status": "affected", "version": "2.3.8", "lessThan": "2.5.1", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-01-02T22:15:44.403", "references": [{"url": "https://www.dragos.com/community/advisories/CVE-2025-64119", "tags": ["Third Party Advisory"], "source": "ot-cert@dragos.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ot-cert@dragos.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows OS Command Injection.This issue affects Multi-Stack Controller (MSC): from 2.3.8 before 2.5.1."}, {"lang": "es", "value": "Una vulnerabilidad de neutralizaci\u00f3n incorrecta de elementos especiales utilizados en un comando del sistema operativo ('inyecci\u00f3n de comandos del SO') en Nuvation Energy Multi-Stack Controller (MSC) permite la inyecci\u00f3n de comandos del SO. Este problema afecta a Multi-Stack Controller (MSC): desde 2.3.8 antes de 2.5.1."}], "lastModified": "2026-10-07T11:10:00.153", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nuvationenergy:nplatform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "28374037-4F31-4DD9-B022-BBADEC48DBF5", "versionEndExcluding": "2.5.1", "versionStartIncluding": "2.3.8"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:nuvationenergy:nuvmsc3-04s-c:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F7962681-518E-463D-889B-FA02F9C8DF4A"}, {"criteria": "cpe:2.3:h:nuvationenergy:nuvmsc3-08s-c:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "9C8840C4-E139-4AF7-9B4C-DE42B69FC97D"}, {"criteria": "cpe:2.3:h:nuvationenergy:nuvmsc3-12s-c:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1E01ABFC-C5D6-4EAD-9109-BA76A946FF58"}, {"criteria": "cpe:2.3:h:nuvationenergy:nuvmsc3-16s-c:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "3D41387A-89AB-4095-8DCA-181DE5695C5D"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ot-cert@dragos.com"}