CVE-2023-39544 Auth bypass in CLUSTERPRO X SingleServerSafe (EXPRESSCLUSTER X SingleServerSafe)

What is CVE-2023-39544?

CVE-2023-39544 is a high-severity authentication bypass vulnerability in NEC Corporation CLUSTERPRO X SingleServerSafe (EXPRESSCLUSTER X SingleServerSafe), published on 17 Nov 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows a attacker to log in to the product may execute an arbitrary command.

Weakness: CWE-862

Which versions are affected by CVE-2023-39544?

It affects 2 products.

Products include Nec Expresscluster X, Nec Expresscluster X Singleserversafe.

How do I fix CVE-2023-39544?

No fix has been published for CVE-2023-39544 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2023-39544 being exploited?

There is no known exploitation of CVE-2023-39544 in the wild and no public exploit code.

Other vulnerabilities in NEC Corporation CLUSTERPRO X SingleServerSafe (EXPRESSCLUSTER X SingleServerSafe)

• CVE-2022-34822 Path traversal in CLUSTERPRO X Critical 9.8
• CVE-2022-34823 Memory corruption in CLUSTERPRO X Critical 9.8
• CVE-2022-34824 Path traversal in CLUSTERPRO X Critical 9.8
• CVE-2022-34825 Path traversal in CLUSTERPRO X Critical 9.8
• CVE-2023-39545 Command injection in CLUSTERPRO X (EXPRESSCLUSTER X) High 8.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9vh9-pgv9-hw48.