Critical severity · published Nov 7, 2025
CVE-2025-11546
CLUSTERPRO X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 and EXPRESSCLUSTER X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, CLUSTERPRO X SingleServerSafe for Linux 4.0, 4.1, 4.2, 5.0,…
9.3
CVSS
0.4%
EPSS
No
On KEV
Description
CLUSTERPRO X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 and EXPRESSCLUSTER X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, CLUSTERPRO X SingleServerSafe for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, EXPRESSCLUSTER X SingleServerSafe for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 allows an attacker sends specially crafted network packets to the product, arbitrary OS commands may be executed without authentication.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CX
CLUSTERPRO X SingleServerSafe for Linux (EXPRESSCLUSTER X SingleServerSafe for Linux) · NEC Corporation
4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 · source: vendor
CX
CLUSTERPRO X for Linux (EXPRESSCLUSTER X for Linux) · NEC Corporation
4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 · source: vendor
Affected product
CX
CLUSTERPRO X for Linux (EXPRESSCLUSTER X for Linux)
NEC Corporation