CVSS 8.6 (HIGH) · Actively exploited (listed in CISA KEV)
UnrealIRCd versions before 6.2.7.1 contain a critical vulnerability in the labeled-response module. Attackers can inject server-to-server commands via unescaped IRCv3 label tags, executing them with server authority.
Impact
This flaw allows remote attackers to execute arbitrary commands with elevated privileges on linked servers. It poses a severe risk to the integrity and control of the IRC network infrastructure.
What to do
Upgrade UnrealIRCd to version 6.2.7.1 or later immediately to resolve the issue. Ensure all linked servers are patched to prevent lateral movement and command injection.
中文摘要
UnrealIRCd 6.2.7.1 之前的版本在 labeled-response 模組中存在嚴重漏洞。攻擊者可透過未轉義的 IRCv3 標籤注入伺服器間指令，並以伺服器權限執行。
請立即將 UnrealIRCd 升級至 6.2.7.1 或更高版本以修復此問題。確保所有連結伺服器均已更新，以防止指令注入攻擊。
