CVE-2025-64119: critical vulnerability in Nuvation Energy Battery Management System
Nuvation Energy BMS Client-side Authentication
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Nuvation Battery Management System has a flaw that allows attackers to bypass authentication and gain unauthorized access to the system without valid credentials. This is critical because it exposes battery management controls to anyone who can reach the application.
CWE-603 (client-side authentication) flaw in Nuvation BMS up to version 2.3.9 permits authentication bypass, likely due to insufficient server-side validation of client-side security controls. An attacker can access protected functionality and resources without providing valid credentials, compromising confidentiality and integrity of the battery management system.