CVE-2019-6453

mIRC before 7.55 allows remote command execution by using argument injection through custom URI protocol handlers

published February 18, 2019

Patch now

High probability of exploitation

NVD has not assigned a CVSS score to this record. It sits in the 99.0th percentile for exploit probability.

CVSS
—
EPSS
54%
Percentile
99.0
In the wild
Unconfirmed
What it is

mIRC before 7.55 allows remote command execution by using argument injection through custom URI protocol handlers. The attacker can specify an irc:// URI that loads an arbitrary .ini file from a UNC share pathname. Exploitation depends on browser-specific URI handling (Chrome is not exploitable).

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.54292 · 99.0th percentile
Published
2019-02-18T15:00Z
EPSS history
Timeline
  • 22 SEP 03:18Z
    EPSS moved 54% → 33%
    epss
  • 06 SEP 03:13Z
    EPSS moved 54% → 33%
    epss
  • 30 AUG 16:02Z
    EPSS moved 33% → 54%
    epss
  • 29 AUG 04:55Z
    EPSS moved 54% → 33%
    epss
  • 18 FEB 15:00Z
    mIRC before 7.55 allows remote command execution by using argument injection through custom URI protocol handlers
    cvelistv5