CVE-2001-1091: Netbsd

High severity, CVSS 7.2. EPSS: 0.3% chance of exploitation in the next 30 days.

The (1) dump and (2) dump_lfs commands in NetBSD 1.4.x through 1.5.1 do not properly drop privileges, which could allow local users to gain privileges via the RCMD_CMD environment variable.

Affected products

• Netbsd Netbsd: version 1.4 only; version 1.4.1 only; version 1.4.2 only; version 1.4.3 only; version 1.5 only; version 1.5.1 only

Published 2001-08-23. Last modified 2026-06-16.