NEC CLUSTERPRO and EXPRESSCLUSTER allow unauthenticated command injection
NEC CLUSTERPRO X and EXPRESSCLUSTER X clustering software contain a critical unauthenticated OS command injection vulnerability (CVE-2025-11546, CVSS 9.8).
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
NEC Corporation's CLUSTERPRO X and EXPRESSCLUSTER X clustering software for Linux contain a critical OS command injection vulnerability tracked as CVE-2025-11546. The vulnerability allows unauthenticated attackers to execute arbitrary operating system commands by sending specially crafted network packets to affected systems. No authentication is required to exploit this flaw.
The vulnerability affects multiple versions of both product lines spanning versions 4.0 through 5.2 for Linux, including the SingleServerSafe editions. With a CVSS v3 score of 9.8 (Critical), this represents a severe security risk to organizations running these clustering solutions.
Japan's Information-technology Promotion Agency (IPA) recommends users update to the latest version or implement available workarounds provided by NEC. The advisory was published on November 7, 2025, with additional details available through JVN (JVN#59387134).
Mentioned in this report
Detection guidance
Suspicious Shell Spawned by NEC ClusterPro/EXPRESSCLUSTER Daemon
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a shell interpreter (sh/bash/dash) being spawned as a child of NEC ClusterPro or EXPRESSCLUSTER cluster daemon processes, consistent with OS command injection via CVE-2025-11546. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Shell Spawned by NEC ClusterPro/EXPRESSCLUSTER Daemon
id: 1be5a465-e4f4-5047-9355-eaad7faeea9c
status: experimental
description: 'Detects a shell interpreter (sh/bash/dash) being launched as a direct
child of a ClusterPro or EXPRESSCLUSTER daemon process. This clustering software
listens on network ports without authentication and is vulnerable to OS command
injection (CVE-2025-11546), where an unauthenticated attacker sends crafted packets
that cause the daemon to execute arbitrary shell commands.
'
references:
- https://jvn.jp/en/jp/JVN59387134/
author: Vorant
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|contains:
- clusterpro
- expresscluster
- clsrv
- clp
Image|endswith:
- /sh
- /bash
- /dash
- /ash
filter:
CommandLine|contains:
- /etc/init.d/
- systemctl
- clpstat
- clpcl
condition: selection and not filter
falsepositives:
- Legitimate cluster maintenance scripts invoked by administrators through documented
CLI tools (clpcl, clpstat)
- Scheduled health-check scripts that use shell wrappers as part of normal cluster
operation
level: high
tags:
- attack.t1059
- attack.t1190
Recon or Download Commands Executed by NEC Cluster Software Process
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects common post-exploitation recon or download utilities (whoami, id, uname, curl, wget, nc) executed as children of ClusterPro/EXPRESSCLUSTER processes, indicating possible command injection exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Recon or Download Commands Executed by NEC Cluster Software Process
id: a4bb58c5-4b04-5b05-b2b9-84a11af5518c
status: experimental
description: 'Detects execution of common reconnaissance or download tools (whoami,
id, uname, curl, wget, nc) as a direct child of NEC ClusterPro or EXPRESSCLUSTER
daemon processes. This pattern is consistent with successful exploitation of CVE-2025-11546,
an unauthenticated OS command injection vulnerability that allows attackers to execute
arbitrary commands via crafted network packets to the clustering service.
'
references:
- https://jvn.jp/en/jp/JVN59387134/
author: Vorant
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|contains:
- clusterpro
- expresscluster
- clsrv
- clp
Image|endswith:
- /whoami
- /id
- /uname
- /curl
- /wget
- /nc
- /ncat
- /python3
- /perl
condition: selection
falsepositives:
- Cluster diagnostic scripts that legitimately gather system information (uname, whoami)
for support bundles
- Custom monitoring integrations that call curl/wget from cluster resource scripts
level: high
tags:
- attack.t1059
- attack.t1190
Inbound Connection to NEC Cluster Service Port Followed by Local Command Execution
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects a new network connection to a ClusterPro/EXPRESSCLUSTER listening service closely followed by process creation from the cluster daemon, indicating possible exploitation of the unauthenticated command injection vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Inbound Connection to NEC Cluster Service Port Followed by Local Command Execution
id: f0ceaa7b-99c3-5771-863c-8d0799514c23
status: experimental
description: 'Detects process creation events originating from ClusterPro/EXPRESSCLUSTER
daemon binaries that also have an active listening network socket, where the daemon
spawns an unexpected child process. This behavior aligns with exploitation of CVE-2025-11546,
which allows unauthenticated remote attackers to trigger OS command execution via
crafted network packets sent to the exposed clustering service.
'
references:
- https://jvn.jp/en/jp/JVN59387134/
author: Vorant
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|contains:
- clusterpro
- expresscluster
- clsrv
- clp
Image|contains:
- /sh
- /bash
- /python
- /perl
- /curl
- /wget
filter:
ParentCommandLine|contains:
- clpcl
- clpstat
- clpregctrl
condition: selection and not filter
falsepositives:
- Administrative use of cluster CLI utilities that internally shell out for configuration
tasks
- Legitimate health-check or failover scripts triggered by cluster state changes
level: medium
tags:
- attack.t1190
- attack.t1059
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.ipa.go.jp/security/security-alert/2025/20251107-jvn.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs