CVE-2025-64123 is an unintended proxy flaw in the Nuvation Energy Multi-Stack Controller, scored CVSS 9.8, that can bridge network boundaries. The NVD record covers releases through and including 2.5.1, and Dragos lists it as unfixed, so isolation and vendor contact are the actions.
What's affected
The NVD record says the Multi-Stack Controller is affected through and including release 2.5.1. The weakness is CWE-441, unintended proxy or intermediary, with the effect described as network boundary bridging.
The Dragos advisory lists this flaw, with its own score of 9.9, as still present and affecting the MSC including the current release at the time of writing. It is therefore different from the other CVEs in the set, such as the authentication bypass CVE-2025-64121, which nPlatform 2.5.1 fixes. I did not find a fixed version for this one, so ask Nuvation for its current status.
How to check if you're exposed
Read the nPlatform version on each MSC. Assume any version up to and including 2.5.1 is affected by this CVE. Check with Nuvation Energy whether a later release addresses it.
Then map the device's network connections. A device that proxies traffic can connect networks that should be separate. List the networks the MSC can reach and the networks that can reach it, and check what sits on each side. Pay attention to links between the operations network and any business network or the nCloud service.
What to do now
- Ask Nuvation Energy for the status of CVE-2025-64123 and record the answer.
- Upgrade to nPlatform 2.5.1 anyway, because it fixes the other issues Dragos lists.
- Place the MSC and battery management system in a network zone that untrusted systems cannot reach, with firewall rules that name the few allowed flows.
- Block the MSC from initiating connections to networks it has no reason to reach.
- Restrict access to the nCloud service where you can.
- Monitor traffic from the MSC for connections to unexpected destinations.
Why it matters
The class is CWE-441, unintended proxy or intermediary. A device meant to serve one purpose can be made to forward requests for someone else, so a party who can reach the device can indirectly reach whatever the device can reach. In an industrial network, that can carry an attacker from an exposed segment to equipment that is meant to be isolated.
When a flaw has no fix, the defence is architecture. Zoning, one way flows and firewall rules that deny by default limit what a proxy can reach even if the device is willing. Dragos also recommends protecting both the MSC and the battery management system from adversarial networks.
The KEV flag is false. The honest summary is that this is a risk you manage with controls until the vendor states a fix.
Quick check
Does upgrading to 2.5.1 fix this one?
The record covers releases through and including 2.5.1, and Dragos lists the flaw as still present in the current release, so no. Ask the vendor for status.
Sources
Last reviewed: 19 October 2026.
