Vulnerability · Published Nov 7, 2025 · Assigned by NEC
CVE-2025-11546
Critical 9.3
In plain English
A critical-severity OS command injection in CLUSTERPRO X for Linux (EXPRESSCLUSTER X for Linux) from NEC Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).
Official description
CLUSTERPRO X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 and EXPRESSCLUSTER X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, CLUSTERPRO X SingleServerSafe for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, EXPRESSCLUSTER X SingleServerSafe for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 allows an attacker sends specially crafted network packets to the product, arbitrary OS commands may be executed without authentication.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| NEC Corporation | CLUSTERPRO X for Linux (EXPRESSCLUSTER X for Linux) | 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 |
| NEC Corporation | CLUSTERPRO X SingleServerSafe for Linux (EXPRESSCLUSTER X SingleServerSafe for Linux) | 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 |
Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N