Read the docs
TI-2023-20678 Aliases CVE-2023-39546GHSA-9c6c-9p8c-7g7v

CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X…

Priority MEDIUM 41CWE-836Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows a attacker to log in to the product may execute an arbitrary command.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00632 50th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NEC CorporationCLUSTERPRO X (EXPRESSCLUSTER X)1.0, 2.0 2.1, 3.0, 3.1, 3.2, 4.0, 4.1, 4.2, 5.0 and 5.1—No fix listedCNA
NEC CorporationCLUSTERPRO X SingleServerSafe (EXPRESSCLUSTER X SingleServerSafe)1.0, 2.0 2.1, 3.0, 3.1, 3.2, 4.0, 4.1, 4.2, 5.0 and 5.1—No fix listedCNA
  • CLUSTERPRO X (EXPRESSCLUSTER X) VendorNEC Corporation Affected 1.0, 2.0 2.1, 3.0, 3.1, 3.2, 4.0, 4.1, 4.2, 5.0 and 5.1 Fixed in — No fix listed CNA
  • CLUSTERPRO X SingleServerSafe (EXPRESSCLUSTER X SingleServerSafe) VendorNEC Corporation Affected 1.0, 2.0 2.1, 3.0, 3.1, 3.2, 4.0, 4.1, 4.2, 5.0 and 5.1 Fixed in — No fix listed CNA

CPE configurations NVD · 52

CPEVersionsRoleVendor
cpe:2.3:a:nec:expresscluster_x:1.0:*:*:*:*:linux:*:*1.0VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x:1.0:*:*:*:*:windows:*:*1.0VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x:2.0:*:*:*:*:linux:*:*2.0VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x:2.0:*:*:*:*:windows:*:*2.0VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x:2.1:*:*:*:*:linux:*:*2.1VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x:2.1:*:*:*:*:windows:*:*2.1VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x:3.0:*:*:*:*:linux:*:*3.0VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x:3.0:*:*:*:*:windows:*:*3.0VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x:3.1:*:*:*:*:linux:*:*3.1VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x:3.1:*:*:*:*:windows:*:*3.1VulnerableNEC Corporation
  • cpe:2.3:a:nec:expresscluster_x:1.0:*:*:*:*:linux:*:* Versions 1.0 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x:1.0:*:*:*:*:windows:*:* Versions 1.0 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x:2.0:*:*:*:*:linux:*:* Versions 2.0 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x:2.0:*:*:*:*:windows:*:* Versions 2.0 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x:2.1:*:*:*:*:linux:*:* Versions 2.1 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x:2.1:*:*:*:*:windows:*:* Versions 2.1 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x:3.0:*:*:*:*:linux:*:* Versions 3.0 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x:3.0:*:*:*:*:windows:*:* Versions 3.0 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x:3.1:*:*:*:*:linux:*:* Versions 3.1 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x:3.1:*:*:*:*:windows:*:* Versions 3.1 Vulnerable ·NEC Corporation
Show 42 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:nec:expresscluster_x:3.2:*:*:*:*:linux:*:*3.2VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x:3.2:*:*:*:*:windows:*:*3.2VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x:3.3:*:*:*:*:linux:*:*3.3VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x:3.3:*:*:*:*:windows:*:*3.3VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x:4.0:*:*:*:*:linux:*:*4.0VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x:4.0:*:*:*:*:windows:*:*4.0VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x:4.1:*:*:*:*:linux:*:*4.1VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x:4.1:*:*:*:*:windows:*:*4.1VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x:4.2:*:*:*:*:linux:*:*4.2VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x:4.2:*:*:*:*:windows:*:*4.2VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x:4.3:*:*:*:*:linux:*:*4.3VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x:4.3:*:*:*:*:windows:*:*4.3VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x:5.0:*:*:*:*:linux:*:*5.0VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x:5.0:*:*:*:*:windows:*:*5.0VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x:5.1:*:*:*:*:linux:*:*5.1VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x:5.1:*:*:*:*:windows:*:*5.1VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x_singleserversafe:1.0:*:*:*:*:linux:*:*1.0VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x_singleserversafe:1.0:*:*:*:*:windows:*:*1.0VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x_singleserversafe:2.0:*:*:*:*:linux:*:*2.0VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x_singleserversafe:2.0:*:*:*:*:windows:*:*2.0VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x_singleserversafe:2.1:*:*:*:*:linux:*:*2.1VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x_singleserversafe:2.1:*:*:*:*:windows:*:*2.1VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x_singleserversafe:3.0:*:*:*:*:linux:*:*3.0VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x_singleserversafe:3.0:*:*:*:*:windows:*:*3.0VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x_singleserversafe:3.1:*:*:*:*:linux:*:*3.1VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x_singleserversafe:3.1:*:*:*:*:windows:*:*3.1VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x_singleserversafe:3.2:*:*:*:*:linux:*:*3.2VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x_singleserversafe:3.2:*:*:*:*:windows:*:*3.2VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x_singleserversafe:3.3:*:*:*:*:linux:*:*3.3VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x_singleserversafe:3.3:*:*:*:*:windows:*:*3.3VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x_singleserversafe:4.0:*:*:*:*:linux:*:*4.0VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x_singleserversafe:4.0:*:*:*:*:windows:*:*4.0VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x_singleserversafe:4.1:*:*:*:*:linux:*:*4.1VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x_singleserversafe:4.1:*:*:*:*:windows:*:*4.1VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x_singleserversafe:4.2:*:*:*:*:linux:*:*4.2VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x_singleserversafe:4.2:*:*:*:*:windows:*:*4.2VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x_singleserversafe:4.3:*:*:*:*:linux:*:*4.3VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x_singleserversafe:4.3:*:*:*:*:windows:*:*4.3VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x_singleserversafe:5.0:*:*:*:*:linux:*:*5.0VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x_singleserversafe:5.0:*:*:*:*:windows:*:*5.0VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x_singleserversafe:5.1:*:*:*:*:linux:*:*5.1VulnerableNEC Corporation
cpe:2.3:a:nec:expresscluster_x_singleserversafe:5.1:*:*:*:*:windows:*:*5.1VulnerableNEC Corporation
  • cpe:2.3:a:nec:expresscluster_x:3.2:*:*:*:*:linux:*:* Versions 3.2 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x:3.2:*:*:*:*:windows:*:* Versions 3.2 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x:3.3:*:*:*:*:linux:*:* Versions 3.3 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x:3.3:*:*:*:*:windows:*:* Versions 3.3 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x:4.0:*:*:*:*:linux:*:* Versions 4.0 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x:4.0:*:*:*:*:windows:*:* Versions 4.0 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x:4.1:*:*:*:*:linux:*:* Versions 4.1 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x:4.1:*:*:*:*:windows:*:* Versions 4.1 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x:4.2:*:*:*:*:linux:*:* Versions 4.2 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x:4.2:*:*:*:*:windows:*:* Versions 4.2 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x:4.3:*:*:*:*:linux:*:* Versions 4.3 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x:4.3:*:*:*:*:windows:*:* Versions 4.3 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x:5.0:*:*:*:*:linux:*:* Versions 5.0 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x:5.0:*:*:*:*:windows:*:* Versions 5.0 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x:5.1:*:*:*:*:linux:*:* Versions 5.1 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x:5.1:*:*:*:*:windows:*:* Versions 5.1 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x_singleserversafe:1.0:*:*:*:*:linux:*:* Versions 1.0 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x_singleserversafe:1.0:*:*:*:*:windows:*:* Versions 1.0 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x_singleserversafe:2.0:*:*:*:*:linux:*:* Versions 2.0 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x_singleserversafe:2.0:*:*:*:*:windows:*:* Versions 2.0 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x_singleserversafe:2.1:*:*:*:*:linux:*:* Versions 2.1 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x_singleserversafe:2.1:*:*:*:*:windows:*:* Versions 2.1 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x_singleserversafe:3.0:*:*:*:*:linux:*:* Versions 3.0 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x_singleserversafe:3.0:*:*:*:*:windows:*:* Versions 3.0 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x_singleserversafe:3.1:*:*:*:*:linux:*:* Versions 3.1 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x_singleserversafe:3.1:*:*:*:*:windows:*:* Versions 3.1 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x_singleserversafe:3.2:*:*:*:*:linux:*:* Versions 3.2 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x_singleserversafe:3.2:*:*:*:*:windows:*:* Versions 3.2 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x_singleserversafe:3.3:*:*:*:*:linux:*:* Versions 3.3 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x_singleserversafe:3.3:*:*:*:*:windows:*:* Versions 3.3 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x_singleserversafe:4.0:*:*:*:*:linux:*:* Versions 4.0 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x_singleserversafe:4.0:*:*:*:*:windows:*:* Versions 4.0 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x_singleserversafe:4.1:*:*:*:*:linux:*:* Versions 4.1 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x_singleserversafe:4.1:*:*:*:*:windows:*:* Versions 4.1 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x_singleserversafe:4.2:*:*:*:*:linux:*:* Versions 4.2 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x_singleserversafe:4.2:*:*:*:*:windows:*:* Versions 4.2 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x_singleserversafe:4.3:*:*:*:*:linux:*:* Versions 4.3 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x_singleserversafe:4.3:*:*:*:*:windows:*:* Versions 4.3 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x_singleserversafe:5.0:*:*:*:*:linux:*:* Versions 5.0 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x_singleserversafe:5.0:*:*:*:*:windows:*:* Versions 5.0 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x_singleserversafe:5.1:*:*:*:*:linux:*:* Versions 5.1 Vulnerable ·NEC Corporation
  • cpe:2.3:a:nec:expresscluster_x_singleserversafe:5.1:*:*:*:*:windows:*:* Versions 5.1 Vulnerable ·NEC Corporation

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-39546
  2. 2026-10-03 Alias added: GHSA-9c6c-9p8c-7g7v
  3. 2026-10-26 EPSS moved to the 50th–90th percentile

References

Advisory 1

  • TI-2020-13174 XML external entity injection in NEC Corporation ExpressCluster CVSS 3.1HIGH 7.5
  • TI-2022-15632 Uncontrolled search path in NEC Corporation CLUSTERPRO X CVSS 3.1CRITICAL 9.8
  • TI-2022-15631 Incorrect default permissions in NEC Corporation CLUSTERPRO X CVSS 3.1CRITICAL 9.8
  • TI-2022-15630 Buffer overflow in NEC Corporation CLUSTERPRO X CVSS 3.1CRITICAL 9.8
  • TI-2022-15629 Path traversal in NEC Corporation CLUSTERPRO X CVSS 3.1CRITICAL 9.8
  • TI-2021-03930 Buffer overflow in NEC Corporation CLUSTERPRO X CVSS 3.1CRITICAL 9.8
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences