CVE-2025-11546CWE-78command-injection

CVE-2025-11546

published November 7, 2025

CVSS
9.3
EPSS
0%
Percentile
29.1
In the wild
Unconfirmed
What it is

CLUSTERPRO X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 and EXPRESSCLUSTER X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, CLUSTERPRO X SingleServerSafe for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, EXPRESSCLUSTER X SingleServerSafe for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 allows an attacker sends specially crafted network packets to the product, arbitrary OS commands may be executed without authentication.

The record
Technical detail
CVSS
9.3 · NONE
CVSS v4.0
Not supplied
EPSS
0.00364 · 29.1th percentile
Weakness
CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published
2025-11-07T07:15Z
References (1)
https://jpn.nec.com/security-info/secinfo/nv25-006_en.html · [email protected]
EPSS history
Timeline
  • 07 NOV 01:09Z
    CLUSTERPRO X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2 and EXPRESSCLUSTER X for Linux 4.0, 4.1, 4.2, 5.0, 5.1 and 5.2, CLUSTERPRO X SingleServerSafe for Linux…
    cvelistv5