← Vulnerability feed

Vulnerability record · CVE-2022-34825 · published 8 November 2022

CVE-2022-34825: Nec expresscluster x uncontrolled search path element vulnerability

Nec · Expresscluster X

Uncontrolled Search Path Element in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 5.0 SingleServerSafe for Windows and earlier allows a remote unauthenticated attacker to overwrite existing files on the file system and to potentially execute arbitrary code.

9.8 CVSS 3.1 Critical EPSS 1.3% · top 30.8% CWE-427 · Uncontrolled search path element
9.8CVSS 3.1 base score
1.3%EPSS exploitation probability, 30 days
NoNot in CISA KEV
2Affected product versions listed by NVD
2References
17 Jun 2026Last modified by NVD

Description

Uncontrolled Search Path Element in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 5.0 SingleServerSafe for Windows and earlier allows a remote unauthenticated attacker to overwrite existing files on the file system and to potentially execute arbitrary code.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

2 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://jpn.nec.com/security-info/secinfo/nv22-014_en.html Vendor Advisory
https://jpn.nec.com/security-info/secinfo/nv22-014_en.html Vendor Advisory

Track CVE-2022-34825 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-34824Nec expresscluster x incorrect default permissions vulnerabilityWeak File and Folder Permissions vulnerability in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO …EPSS 1.2%9.8CVE-2022-34822Nec expresscluster x path traversal vulnerabilityPath traversal vulnerability in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 SingleServer…EPSS 1.5%9.8CVE-2022-34823Nec expresscluster x classic buffer overflow vulnerabilityBuffer overflow vulnerability in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 SingleServe…EPSS 1.4%9.8CVE-2021-20700Nec clusterpro x classic buffer overflow vulnerabilityBuffer overflow vulnerability in the Disk Agent CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X …EPSS 2.1%9.8CVE-2021-20701Nec clusterpro x classic buffer overflow vulnerabilityBuffer overflow vulnerability in the Disk Agent CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUSTERPRO X …EPSS 2.1%9.8CVE-2021-20702Nec clusterpro x classic buffer overflow vulnerabilityBuffer overflow vulnerability in the Transaction Server CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUST…EPSS 2.2%9.8CVE-2021-20703Nec clusterpro x classic buffer overflow vulnerabilityBuffer overflow vulnerability in the Transaction Server CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows and earlier, CLUST…EPSS 2.1%9.8CVE-2021-20704Nec clusterpro x classic buffer overflow vulnerabilityBuffer overflow vulnerability in the compatible API with previous versions CLUSTERPRO X 4.3 for Windows and earlier, EXPRESSCLUSTER X 4.3 for Windows…EPSS 2.1%

Source: NIST National Vulnerability Database (record CVE-2022-34825), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.