CVE-2001-0800: IRIX lpsched remote command execution via shell metacharacters

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

critical priorityCVSS v2 score of 10 with network reachability, no authentication and complete impact, plus high EPSS, makes this a top-priority exposure despite the absence of KEV listing.

What it is

The IRIX print scheduler lpsched fails to neutralize shell metacharacters in input, allowing remote attackers to run arbitrary commands. The flaw affects IRIX 6.5.13f and earlier and carries a maximum CVSS v2 score of 10, so any reachable host is fully exposed.

Impact

An attacker gains arbitrary command execution on the target host, typically with the privileges of the lpsched process, which can lead to full system compromise given the CVSS impact ratings of complete confidentiality, integrity and availability loss.

Attack surface

Reachable over the network (AV:N) with no authentication (Au:N) and no user interaction, per the CVSS v2 vector; the attack targets the lpsched service listening on the host.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is high at roughly 0.54 (99th percentile) and a public exploit reference exists, indicating meaningful real-world exploitation likelihood.

What to do

• Apply the SGI vendor patch referenced in advisory 20011003-02-P as the first action.
• If patching is not possible, restrict network access to the lpsched service to trusted hosts only.
• Disable or stop the lpsched service on systems that do not require printing.
• Segment or firewall legacy IRIX 6.5.13f and earlier hosts from untrusted networks.
• Monitor vendor advisories for any updated guidance for end-of-life IRIX systems.

Detection

• Inspect lpsched logs and process accounting for unexpected child processes or shell invocations spawned by the scheduler.
• Alert on network connections to the lpsched service from untrusted or unexpected source addresses.
• Hunt for shell metacharacter patterns (such as ;, |, backticks, $()) in print job or scheduler input reaching lpsched.
• Correlate process creation events on IRIX hosts with lpsched as the parent for suspicious command lines.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.