Security readout for executives and security teams
Plain-English summary
CVE-2002-0652 affects xfsmd on SGI IRIX 6.5 through 6.5.16. A remote attacker could potentially run arbitrary code by sending input containing shell metacharacters that are mishandled. This is mainly a legacy-system risk, but any remaining exposed IRIX systems should be treated seriously.
Executive priority
Prioritize if the organization still operates IRIX systems, especially in production, manufacturing, research, or archival environments. The business risk is high for exposed systems because the stated impact is remote code execution, but relevance depends on whether these legacy assets exist.
Technical view
The record describes insufficient filtering of shell metacharacters before several popen() calls in xfsmd, including export_fs(). The resulting command-injection condition may allow remote arbitrary code execution. The provided sources do not include CVSS, CWE, patch details, or detailed affected package metadata beyond IRIX 6.5 through 6.5.16.
Likely exposure
Exposure is likely limited to legacy SGI IRIX environments still running xfsmd, especially where the service is reachable over a network. Modern environments are unlikely to be affected unless they retain IRIX systems for specialized workloads.
Exploitation context
The CVE states remote code execution is possible, but the provided sources do not show active exploitation, KEV listing, public exploit status, or attacker prevalence. Treat internet- or untrusted-network exposure as high risk due to the impact.
Researcher notes
Source data is sparse and old. The CVE description is the primary evidence: xfsmd, IRIX 6.5 through 6.5.16, shell metacharacter filtering failure, popen(), and remote arbitrary code execution. No authoritative remediation, CVSS vector, or exploitation evidence is included in the provided bundle.
Mitigation direction
- Identify any SGI IRIX 6.5 through 6.5.16 systems running xfsmd.
- Check archived SGI or vendor guidance for fixes or supported upgrade paths.
- Disable xfsmd where it is not required for business operations.
- Restrict network access to xfsmd to trusted management networks only.
- Segment legacy IRIX hosts from user and internet-facing networks.
Validation and detection
- Inventory IRIX hosts and confirm exact OS release levels.
- Determine whether xfsmd is installed and running.
- Review network exposure for the xfsmd service.
- Confirm whether vendor patches or upgrades were historically applied.
- Monitor legacy host logs for unexpected xfsmd activity.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
Execution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2002-0652 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.