CVE-2025-64119

The vulnerability classified as CWE-603 (Use of Client-Side Authentication) means that the authentication mechanism is implemented on the client side or in a way vulnerable to bypass without possessing valid credentials. An attacker remotely, without any authentication and without user interaction, can bypass identity verification and gain unauthorized access to the system. The vulnerability affects all versions of the Battery Management System software up to and including version 2.3.9.

An attacker can gain unauthorized access to the battery management system, which may result in breach of confidentiality, integrity, and availability of the system, and in an industrial environment — potentially disrupt the operation of power infrastructure.

Apply patches available from the manufacturer according to the references. It is recommended to isolate BMS devices from the public network and restrict network access only to trusted hosts until updates are implemented. More information in the Dragos advisory: https://www.dragos.com/community/advisories/CVE-2025-64119

Nuvation Battery Management System in versions up to and including 2.3.9.