CVE-2001-0800

published 2001-12-06

CVE-2001-0800: lpsched in IRIX 6.5.13f and earlier allows remote attackers to execute arbitrary commands via shell metacharacters.

Priority P3 49 critical 10 CVSS 2.0

AV N AC L Au N C C I C A C

EXPLOIT

lpsched in IRIX 6.5.13f and earlier allows remote attackers to execute arbitrary commands via shell metacharacters.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
sgi	irix	<= 6.5.13f	—

Detection & IOCs extracted from sources · hover to see the quote

port 515↗

command T;uname -a; ↗

command T;{payload.encoded}; ↗

• → Detect exploitation attempts by monitoring LPD (port 515/TCP) traffic for lines beginning with 'T;' followed by shell metacharacters or command strings — this is the malicious tagprinter request format used to inject arbitrary commands into lpsched. ↗
• → The exploit targets the in.lpd service (lpsched) on IRIX 6.5.13f and earlier; alert on unexpected process spawning (e.g., shell children) from the lpsched/in.lpd process. ↗

• · The Metasploit module payload is constrained to 512 bytes and requires a 'cmd' payload type with 'generic telnet' compatibility; payloads exceeding this space or using other types will not function correctly. ↗
• · The module is described as non-privileged ('Privileged' => false), meaning the resulting command execution context may be limited to the LPD service account rather than root. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.