Nuvation Energy Multi-Stack Controller OS Command Injection Vulnerability

A vulnerability allowing OS command injection has been identified in Nuvation Energy's Multi-Stack Controller (MSC) versions 2.3.8 prior to 2.5.1. This vulnerability arises from improper neutralization of special elements used in OS commands, allowing for unauthorized command execution on the operating system.

Impact

Exploitation of this vulnerability allows for OS command injection, where an attacker can execute arbitrary commands on the server's operating system.

Remediation

Users are advised to update their Multi-Stack Controller to version 2.5.1. Consult Nuvation's documentation for instructions on enabling authentication and setting a strong password. Security-conscious users may also wish to restrict access to the nCloud service if it is not necessary for their operations.