External risk intelligence

CLUSTERPRO and EXPRESSCLUSTER Remote Command Execution

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2025-11546

The affected products are high-availability clustering software designed for internal server management and failover operations. While these services communicate over the network, they are typically deployed within isolated, trusted backend infrastructure rather than exposed directly to the public internet.

OS Command Injection

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability in certain clustering software that allows unauthenticated attackers to execute arbitrary operating system commands remotely. The main concern is to confirm whether these specific products are in use and, if so, to understand the potential exposure.

Unauthenticated remote command execution flaw.
Leadership should remember to confirm product relevance.
Confirm product usage and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted network packets to the affected clustering software. This could allow them to execute arbitrary commands on the underlying operating system without needing any prior authentication.

Network access required.
Specially crafted packets trigger vulnerability.
Arbitrary OS command execution.

Live Threat

Current exploitation, exposure, and threat context

An unauthenticated attacker could execute arbitrary operating system commands on affected systems by sending specially crafted network packets. This could impact the integrity and availability of the server cluster.

Arbitrary OS command execution.
Specially crafted network packets sent.
Cluster integrity and availability.

Operational Fix

Recommended remediation, mitigation, and detection steps

To address this critical vulnerability, the platform and infrastructure teams are likely responsible for managing CLUSTERPRO X and EXPRESSCLUSTER X. The first practical step involves identifying all instances of the affected clustering software, assessing their network exposure and business criticality, and then coordinating with the accountable owners to plan remediation.

Platform and infrastructure teams should own.
Verify network exposure and business criticality.
Plan vendor coordination for remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is CLUSTERPRO and EXPRESSCLUSTER?

These are high-availability clustering and failover software solutions for Linux. Organizations use them to ensure critical applications remain online by managing server redundancy and service recovery. They act as the heartbeat for backend infrastructure, coordinating how data and services migrate between servers during system maintenance or unexpected hardware failures.

How does CVE-2025-11546 impact system security?

This vulnerability is classified as CWE-78, which is the improper neutralization of special elements used in an OS command. In simpler terms, the software fails to properly filter instructions sent to it, allowing an attacker to inject and execute their own operating system commands. Because this flaw exists in how the software processes data, it grants unauthorized control over the server hosting the cluster.

What triggers this command execution bug?

An attacker triggers this by sending specially crafted network packets directly to the affected service. The vulnerability relies on the software's ability to receive and interpret these malicious instructions over the network. Simply having the software installed or running does not trigger the flaw; it requires active network communication specifically designed to exploit the processing logic.

Is my infrastructure at risk from this vulnerability?

According to Halo Surface Signal, this software is typically designed for internal server management and is generally kept within isolated, trusted backend infrastructure. While the potential for remote exploitation exists, the actual risk depends on your network architecture. Systems not reachable from untrusted zones or the public internet face a significantly lower likelihood of being targeted.

What should I do if I use these products?

Begin by auditing your environment to identify all instances of CLUSTERPRO or EXPRESSCLUSTER. Once identified, evaluate whether these servers are accessible from external networks. Coordinate with your platform and infrastructure teams to verify business criticality and monitor for official updates or vendor-provided configuration guidance to secure your environment.

References

jpn.nec.com/security-info/secinfo/nv25-006_en.html

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.