VORANT. Threat Intelligence Sign in Get the full feed

NEC CLUSTERPRO X and EXPRESSCLUSTER X clustering software contain a critical…

critical vulnerability

NEC CLUSTERPRO X and EXPRESSCLUSTER X clustering software contain a critical unauthenticated OS command injection vulnerability (CVE-2025-11546, CVSS 9.8).

NEC Corporation's CLUSTERPRO X and EXPRESSCLUSTER X clustering software for Linux contain a critical OS command injection vulnerability tracked as CVE-2025-11546. The vulnerability allows unauthenticated attackers to execute arbitrary operating system commands by sending specially crafted network packets to affected systems. No authentication is required to exploit this flaw.

The vulnerability affects multiple versions of both product lines spanning versions 4.0 through 5.2 for Linux, including the SingleServerSafe editions. With a CVSS v3 score of 9.8 (Critical), this represents a severe security risk to organizations running these clustering solutions.

Japan's Information-technology Promotion Agency (IPA) recommends users update to the latest version or implement available workarounds provided by NEC. The advisory was published on November 7, 2025, with additional details available through JVN (JVN#59387134).

Mentioned in this report

Vulnerabilities CVE-2025-11546

Detection guidance

Suspicious Shell Spawned by NEC ClusterPro/EXPRESSCLUSTER Daemon

ATT&CK T1059

Detects a shell interpreter (sh/bash/dash) being spawned as a child of NEC ClusterPro or EXPRESSCLUSTER cluster daemon processes, consistent with OS command injection via CVE-2025-11546. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Shell Spawned by NEC ClusterPro/EXPRESSCLUSTER Daemon
id: 1be5a465-e4f4-5047-9355-eaad7faeea9c
status: experimental
description: 'Detects a shell interpreter (sh/bash/dash) being launched as a direct
  child of a ClusterPro or EXPRESSCLUSTER daemon process. This clustering software
  listens on network ports without authentication and is vulnerable to OS command
  injection (CVE-2025-11546), where an unauthenticated attacker sends crafted packets
  that cause the daemon to execute arbitrary shell commands.

  '
references:
- https://jvn.jp/en/jp/JVN59387134/
author: Vorant
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains:
    - clusterpro
    - expresscluster
    - clsrv
    - clp
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /ash
  filter:
    CommandLine|contains:
    - /etc/init.d/
    - systemctl
    - clpstat
    - clpcl
  condition: selection and not filter
falsepositives:
- Legitimate cluster maintenance scripts invoked by administrators through documented
  CLI tools (clpcl, clpstat)
- Scheduled health-check scripts that use shell wrappers as part of normal cluster
  operation
level: high
tags:
- attack.t1059
- attack.t1190

Recon or Download Commands Executed by NEC Cluster Software Process

ATT&CK T1059

Detects common post-exploitation recon or download utilities (whoami, id, uname, curl, wget, nc) executed as children of ClusterPro/EXPRESSCLUSTER processes, indicating possible command injection exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Recon or Download Commands Executed by NEC Cluster Software Process
id: a4bb58c5-4b04-5b05-b2b9-84a11af5518c
status: experimental
description: 'Detects execution of common reconnaissance or download tools (whoami,
  id, uname, curl, wget, nc) as a direct child of NEC ClusterPro or EXPRESSCLUSTER
  daemon processes. This pattern is consistent with successful exploitation of CVE-2025-11546,
  an unauthenticated OS command injection vulnerability that allows attackers to execute
  arbitrary commands via crafted network packets to the clustering service.

  '
references:
- https://jvn.jp/en/jp/JVN59387134/
author: Vorant
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains:
    - clusterpro
    - expresscluster
    - clsrv
    - clp
    Image|endswith:
    - /whoami
    - /id
    - /uname
    - /curl
    - /wget
    - /nc
    - /ncat
    - /python3
    - /perl
  condition: selection
falsepositives:
- Cluster diagnostic scripts that legitimately gather system information (uname, whoami)
  for support bundles
- Custom monitoring integrations that call curl/wget from cluster resource scripts
level: high
tags:
- attack.t1059
- attack.t1190

Inbound Connection to NEC Cluster Service Port Followed by Local Command Execution

ATT&CK T1190

Detects a new network connection to a ClusterPro/EXPRESSCLUSTER listening service closely followed by process creation from the cluster daemon, indicating possible exploitation of the unauthenticated command injection vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Inbound Connection to NEC Cluster Service Port Followed by Local Command Execution
id: f0ceaa7b-99c3-5771-863c-8d0799514c23
status: experimental
description: 'Detects process creation events originating from ClusterPro/EXPRESSCLUSTER
  daemon binaries that also have an active listening network socket, where the daemon
  spawns an unexpected child process. This behavior aligns with exploitation of CVE-2025-11546,
  which allows unauthenticated remote attackers to trigger OS command execution via
  crafted network packets sent to the exposed clustering service.

  '
references:
- https://jvn.jp/en/jp/JVN59387134/
author: Vorant
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains:
    - clusterpro
    - expresscluster
    - clsrv
    - clp
    Image|contains:
    - /sh
    - /bash
    - /python
    - /perl
    - /curl
    - /wget
  filter:
    ParentCommandLine|contains:
    - clpcl
    - clpstat
    - clpregctrl
  condition: selection and not filter
falsepositives:
- Administrative use of cluster CLI utilities that internally shell out for configuration
  tasks
- Legitimate health-check or failover scripts triggered by cluster state changes
level: medium
tags:
- attack.t1190
- attack.t1059

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/security/security-alert/2025/20251107-jvn.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free