CVE-2009-1350: Novell NetIdentity Client xtagent.exe RPC pipe remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

critical priorityCVSS 2.0 score of 10 with network-reachable, unauthenticated remote code execution and a high EPSS probability make this a top remediation priority.

What it is

Novell NetIdentity Client before 1.2.4 contains an unspecified vulnerability in xtagent.exe. A remote attacker can connect to the XTIERRPCPIPE named pipe over IPC$ and send crafted RPC messages that cause an arbitrary pointer dereference, leading to code execution. The flaw is an input validation failure in a network-reachable service.

Impact

An unauthenticated remote attacker can execute arbitrary code with the privileges of the xtagent.exe process, giving full control of the affected host. The CVSS 2.0 vector rates complete confidentiality, integrity, and availability impact.

Attack surface

Reachable over the network via an IPC$ connection to the XTIERRPCPIPE named pipe; the CVSS vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required. Any host exposing this pipe to untrusted networks is exposed.

Exploitation

Not listed in CISA KEV and no ransomware associations are documented, but EPSS is high at 0.659 (99.2nd percentile), indicating elevated likelihood of exploitation activity. References include vendor and ZDI advisories with patch tags, but no public exploit code is confirmed in the record.

What to do

• Upgrade Novell NetIdentity Client to 1.2.4 or later using the vendor patch referenced in the advisory.
• Restrict network access to the XTIERRPCPIPE named pipe and IPC$ shares via host firewall or SMB/pipe access controls.
• Disable or remove the NetIdentity Client on systems that do not require it.
• Monitor and block untrusted RPC traffic to affected endpoints at network boundaries.
• Apply least-privilege configuration to the xtagent.exe service account to limit post-exploitation impact.

Detection

• Monitor for unexpected connections to the XTIERRPCPIPE named pipe, especially from remote hosts.
• Audit Windows event logs and Sysmon for named pipe creation and access events involving XTIERRPCPIPE.
• Watch for anomalous process behavior or crashes in xtagent.exe that may indicate exploitation attempts.
• Correlate network RPC traffic to affected hosts with known exploitation patterns or unusual payload sizes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.