CVE-2025-11546

CriticalCVSS 9.3/10Last modified Oct 18, 2026

Description

CLUSTERPRO X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 and EXPRESSCLUSTER X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, CLUSTERPRO X SingleServerSafe for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, EXPRESSCLUSTER X SingleServerSafe for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 allows an attacker sends specially crafted network packets to the product, arbitrary OS commands may be executed without authentication.

Metrics

CVSS 4.0 9.3/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
NEC Corporation	CLUSTERPRO X for Linux (EXPRESSCLUSTER X for Linux)	4.0, 4.1, 4.2, 5.0, 5.1 and 5.2
NEC Corporation	CLUSTERPRO X SingleServerSafe for Linux (EXPRESSCLUSTER X SingleServerSafe for Linux)	4.0, 4.1, 4.2, 5.0, 5.1 and 5.2

References

https://jpn.nec.com/security-info/secinfo/nv25-006_en.html

Timeline

Published: Nov 7, 2025
Last modified: Oct 18, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-115477.8AXIS Camera Station Pro contained a flaw to perform a privilege escalation attack on the server as a non-admin user.CVE-2025-115489.3A remote, unauthenticated privilege escalation in ibi WebFOCUS allows an attacker to gain administrative access to the application which may CVE-2025-115499.8A vulnerability has been found in Tenda W12 3.0.0.6(3948). The affected element is the function wifiMacFilterSet of the file /goform/modules CVE-2025-11556.1A vulnerability, which was classified as problematic, was found in Webkul QloApps 1.6.1. This affects an unknown part of the file /stores of CVE-2025-115506.5A vulnerability was found in Tenda W12 3.0.0.6(3948). The impacted element is the function wifiScheduledSet of the file /goform/modules of t CVE-2025-115519.8A vulnerability was determined in code-projects Student Result Manager 1.0. This affects an unknown function of the file src/students/Databa CVE-2025-115528.8A vulnerability was identified in code-projects Online Complaint Site 1.0. This impacts an unknown function of the file /admin/category.php.CVE-2025-115539.8A weakness has been identified in code-projects Courier Management System 1.0. Affected by this vulnerability is an unknown functionality of CVE-2025-115548.8A security vulnerability has been detected in Portabilis i-Educar up to 2.9.10. Affected by this issue is some unknown functionality of the CVE-2025-115559.8A vulnerability was detected in Campcodes Online Learning Management System 1.0. This affects an unknown part of the file /admin/calendar_of CVE-2025-115569.8A flaw has been found in code-projects Simple Leave Manager 1.0. This vulnerability affects unknown code of the file /user.php. This manipul CVE-2025-115579.8A vulnerability has been found in projectworlds Gate Pass Management System 1.0. This issue affects some unknown processing of the file /add