CVE-2025-64124

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows OS Command Injection.This issue affects Multi-Stack Controller (MSC): before 2.5.1.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.dragos.com/community/advisories/CVE-2025-64119	Third Party Advisory

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:nuvationenergy:nplatform:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:nuvationenergy:nuvmsc3-04s-c:-:::::::*
	cpe:2.3:h:nuvationenergy:nuvmsc3-08s-c:-:::::::*
	cpe:2.3:h:nuvationenergy:nuvmsc3-12s-c:-:::::::*
	cpe:2.3:h:nuvationenergy:nuvmsc3-16s-c:-:::::::*

History

30 Sep 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de neutralización incorrecta de elementos especiales utilizados en un comando del sistema operativo ('Inyección de comandos del sistema operativo') en Nuvation Energy Multi-Stack Controller (MSC) permite la inyección de comandos del sistema operativo. Este problema afecta a Multi-Stack Controller (MSC): versiones anteriores a la 2.5.1.

Information

Published : 2026-01-03 01:15

Updated : 2026-10-07 11:10

NVD link : CVE-2025-64124

Mitre link : CVE-2025-64124

CVE.ORG link : CVE-2025-64124

JSON object : View

Products Affected

nuvationenergy

nuvmsc3-16s-c
nplatform
nuvmsc3-08s-c
nuvmsc3-04s-c
nuvmsc3-12s-c

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2025-64124", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-64124", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-01-05T20:31:24.779187Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "ot-cert@dragos.com", "cvssData": {"Safety": "PRESENT", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.7, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:P/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "ot-cert@dragos.com", "affectedData": [{"vendor": "Nuvation Energy", "product": "Multi-Stack Controller (MSC)", "versions": [{"status": "affected", "version": "0", "lessThan": "2.5.1", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-01-03T01:15:42.750", "references": [{"url": "https://www.dragos.com/community/advisories/CVE-2025-64119", "tags": ["Third Party Advisory"], "source": "ot-cert@dragos.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "ot-cert@dragos.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Nuvation Energy Multi-Stack Controller (MSC) allows OS Command Injection.This issue affects Multi-Stack Controller (MSC): before 2.5.1."}, {"lang": "es", "value": "Una vulnerabilidad de neutralizaci\u00f3n incorrecta de elementos especiales utilizados en un comando del sistema operativo ('Inyecci\u00f3n de comandos del sistema operativo') en Nuvation Energy Multi-Stack Controller (MSC) permite la inyecci\u00f3n de comandos del sistema operativo. Este problema afecta a Multi-Stack Controller (MSC): versiones anteriores a la 2.5.1."}], "lastModified": "2026-10-07T11:10:00.153", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nuvationenergy:nplatform:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F9BA0E2A-0F4B-4705-BB79-DD5F30B40859", "versionEndIncluding": "2.5.1"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:nuvationenergy:nuvmsc3-04s-c:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "F7962681-518E-463D-889B-FA02F9C8DF4A"}, {"criteria": "cpe:2.3:h:nuvationenergy:nuvmsc3-08s-c:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "9C8840C4-E139-4AF7-9B4C-DE42B69FC97D"}, {"criteria": "cpe:2.3:h:nuvationenergy:nuvmsc3-12s-c:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "1E01ABFC-C5D6-4EAD-9109-BA76A946FF58"}, {"criteria": "cpe:2.3:h:nuvationenergy:nuvmsc3-16s-c:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "3D41387A-89AB-4095-8DCA-181DE5695C5D"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "ot-cert@dragos.com"}