RCE in Nec Corporation Clusterpro X For Linux (Expresscluster Linux)
CVE-2025-11546
CLUSTERPRO X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 and EXPRESSCLUSTER X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, CLUSTERPRO X SingleServerSafe for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, EXPRESSCLUSTER X SingleServerSafe for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 allows an attacker sends specially crafted network packets to the product, arbitrary OS commands may be executed without authentication.
Vulnerability class: Command Injection (OS Command Injection)
Published · last modified .
EPSS exploit prediction
EPSS: 0.004 (36.2th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 36th percentile — 36.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Nec Corporation Clusterpro X For Linux (Expresscluster Linux) — versions 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2
- Nec Corporation Clusterpro X Singleserversafe For Linux (Expresscluster Linux) — versions 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2