CVE-2025-64120

The vulnerability results from improper neutralization of special characters passed to operating system commands (CWE-78). The device management application does not properly filter user-supplied input data, which allows embedding additional shell commands. An attacker with basic privileges (PR:L) can send a specially crafted network request and cause the system to execute the provided commands with the privileges of the application process.

Successful exploitation of the vulnerability may allow an attacker to gain full control over the device, steal configuration and operational data, disrupt energy storage installation operations, and potentially affect systems connected to the MSC controller.

Update Multi-Stack Controller (MSC) software to version 2.5.1 or later. If immediate update is not possible, it is recommended to isolate MSC devices from public networks and restrict access only to trusted hosts using firewall or VLAN networks. Detailed information is available in the manufacturer's advisory at the address indicated in the references.

Nuvation Energy Multi-Stack Controller (MSC) in versions from 2.3.8 to 2.5.1 (exclusive), supported by the nPlatform on devices: NuvMSC3-04S-C, NuvMSC3-08S-C, NuvMSC3-12S-C, NuvMSC3-16S-C.