NEC CLUSTERPRO X pre-auth RCE via command injection

6 November 2025 critical vulnerability

NEC's CLUSTERPRO X and EXPRESSCLUSTER X clustering software contains a critical OS command injection flaw allowing unauthenticated remote code execution via crafted network packets.

Japan's IPA has disclosed a critical vulnerability in NEC Corporation's CLUSTERPRO X and EXPRESSCLUSTER X clustering software for Linux. The flaw, tracked as CVE-2025-11546, is an OS command injection vulnerability that allows an unauthenticated attacker to execute arbitrary operating system commands by sending specially crafted network packets to the affected product. No authentication is required to exploit this vulnerability.

The vulnerability affects a wide range of product versions spanning multiple major releases from 4.0 through 5.2, including both the standard CLUSTERPRO X/EXPRESSCLUSTER X products and their SingleServerSafe variants. With a CVSS v3 score of 9.8 (Critical), this represents a severe risk to organizations running these clustering solutions. NEC has released patches and workarounds to address the issue.

Organizations using the affected NEC clustering software should immediately apply the latest updates provided by the vendor or implement the available workarounds. Given the unauthenticated remote nature of the exploit and the critical CVSS score, this vulnerability poses an urgent risk to affected systems and should be prioritized for remediation.

Mentioned in this report

Vulnerabilities CVE-2025-11546

Detection guidance

NEC CLUSTERPRO/EXPRESSCLUSTER Cluster Daemon Spawning Shell Interpreter

ATT&CK T1059

Detects a cluster daemon process (clp*) belonging to NEC CLUSTERPRO X/EXPRESSCLUSTER X spawning a shell or scripting interpreter, consistent with exploitation of the CVE-2025-11546 unauthenticated OS command injection vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: NEC CLUSTERPRO Cluster Daemon Spawning Shell Interpreter
id: 410f8647-5857-56d9-9dbf-1c401b533853
status: experimental
description: 'Detects a process belonging to NEC CLUSTERPRO X/EXPRESSCLUSTER X clustering
  software (binaries typically prefixed ''clp'', e.g. clprc, clpnm, clptrap) spawning
  a shell or scripting interpreter as a child process. This pattern is consistent
  with exploitation of CVE-2025-11546, an unauthenticated OS command injection vulnerability
  that allows arbitrary command execution via crafted network packets sent to the
  clustering service.

  '
references:
- https://www.ipa.go.jp/
author: Vorant
tags:
- attack.t1059
- attack.t1190
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains: clp
    Image|endswith:
    - /sh
    - /bash
    - /dash
    - /ash
    - /python
    - /python3
    - /perl
    - /ksh
  filter_admin:
    ParentCommandLine|contains:
    - clpcl
    - clpstat
    - clpregctrl
  condition: selection and not filter_admin
falsepositives:
- Legitimate cluster administration scripts (clpcl, clpstat, clpregctrl) invoking
  shell interpreters as part of normal cluster maintenance
- Custom monitoring or backup scripts integrated with the clustering software that
  intentionally call shell utilities
level: high

NEC CLUSTERPRO/EXPRESSCLUSTER Cluster Daemon Launching Network Download Utility

ATT&CK T1190

Detects a CLUSTERPRO/EXPRESSCLUSTER cluster daemon process launching common download or remote-access utilities, indicative of post-exploitation payload retrieval following command injection via CVE-2025-11546. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: NEC CLUSTERPRO Cluster Daemon Launching Download Utility
id: 58fa6fc7-d594-5eb4-8d37-c1aaf110c102
status: experimental
description: 'Detects a process belonging to NEC CLUSTERPRO X/EXPRESSCLUSTER X clustering
  software (binaries prefixed ''clp'') spawning a network download or remote-access
  utility such as curl, wget, nc, ncat, or socat. This behaviour is consistent with
  an attacker abusing the unauthenticated OS command injection vulnerability CVE-2025-11546
  to fetch or deliver additional payloads or establish reverse shells.

  '
references:
- https://www.ipa.go.jp/
author: Vorant
tags:
- attack.t1190
- attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    ParentImage|contains: clp
    Image|endswith:
    - /curl
    - /wget
    - /nc
    - /ncat
    - /socat
    - /telnet
  condition: selection
falsepositives:
- Cluster software update or license validation scripts that legitimately invoke curl/wget
  to reach vendor endpoints
- Administrator-initiated diagnostic scripts using nc/socat for network testing from
  cluster nodes
level: high

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ipa.go.jp/security/security-alert/2025/20251107-jvn.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free