CVE-2025-64121 is an authentication bypass in the Nuvation Energy Multi-Stack Controller, scored CVSS 9.8. It uses an alternate path or channel, and it affects nPlatform from 2.3.8 before 2.5.1. Dragos reports the fix in nPlatform 2.5.1, so upgrade and keep the controller off untrusted networks.
What's affected
The NVD record says the Multi-Stack Controller from 2.3.8 before 2.5.1 is affected. The weakness is CWE-288, authentication bypass using an alternate path or channel. The Dragos advisory says this flaw was introduced in nPlatform 2.3.8 and fixed in nPlatform 2.5.1, which corresponds to MSC 22.4.0.
Dragos reviewed Nuvation Energy battery management systems and Multi-Stack Controllers and assigned several CVEs. Others in the set include CVE-2025-64120 and CVE-2025-64124, which are OS command injection, CVE-2025-64122, a private key stored on the device, and CVE-2025-64123, an unintended proxy issue that Dragos lists as still present in the current release. Its sibling record is covered in our guide for CVE-2025-64123.
How to check if you're exposed
On the MSC, read the nPlatform version from its management interface. If it is from 2.3.8 up to below 2.5.1, you are in the range for this CVE. Earlier builds are affected by other issues that Dragos lists as present in all prior builds, so any build below 2.5.1 needs attention.
Then check network placement. These are controllers for battery storage, and Dragos urges that both the MSC and the battery management system be protected from adversarial networks. Look at whether the MSC's management interface is reachable from anything beyond the operations network.
Check whether authentication is enabled on the MSC. Dragos says to consult Nuvation's documentation for enabling it and to set a strong password.
What to do now
- Update the MSC to nPlatform 2.5.1 (MSC 22.4.0) or later.
- Enable authentication on the MSC following Nuvation's documentation, and set a strong, unique password.
- Keep the MSC and the battery management system off the internet and away from business and guest networks.
- Restrict access to the nCloud service as Dragos suggests for security conscious operators.
- Plan for CVE-2025-64123, which Dragos lists as unfixed, with network controls.
- Record Dragos VA-2025-06 as the reference and watch for updates from Nuvation.
Why it matters
The class is CWE-288, authentication bypass using an alternate path or channel. The product checks for credentials on the main route, but another route reaches the same function without the check. An attacker who finds the other route never faces a login.
The scores are high because the vector in the Dragos advisory is network based with no privileges and no user interaction. In operational technology, impact reaches past data: these devices manage energy storage, so loss of control can have physical consequences. That is why the guidance centers on isolation, which holds even when software has flaws.
The set of issues also shows why one fix does not end the work. Dragos lists CVE-2025-64123 as still present, so network controls are the answer there. The KEV flag for this CVE is false.
Quick check
Which version fixes CVE-2025-64121?
nPlatform 2.5.1, which Dragos pairs with MSC 22.4.0.
Is one update enough?
Not for the whole set. Dragos lists CVE-2025-64123 as present in the current release, so isolate the device as well.
Sources
Last reviewed: 19 October 2026.
