ircu 2.10.12.05 and earlier allows remote attackers to discover the hidden IP address of…
Priority LOW 22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · None · None
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
ircu 2.10.12.05 and earlier allows remote attackers to discover the hidden IP address of arbitrary +x users via a series of /silence commands with (1) CIDR mask arguments or (2) certain other arguments that represent groups of IP addresses, then monitoring CTCP ping replies.
Why it matters now
EPSS 0.01183 67th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:universal_ircd:ircu:*:*:*:*:*:*:*:* | up to 2.10.12.05 | Vulnerable | Universal Ircd |
- cpe:2.3:a:universal_ircd:ircu:*:*:*:*:*:*:*:* Versions up to 2.10.12.05 Vulnerable ·Universal Ircd
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2007-4411
- 2026-10-03 Alias added: GHSA-6wgv-cpj2-hjhf
References
Advisory 1
More Universal Ircd Ircu vulnerabilities
- TI-2007-04264 ircu 2.10.12.01 allows remote attackers to (1) cause a denial of service (flood wallops)… CVSS 2.0HIGH 7.8
- TI-2007-04265 ircu 2.10.12.02 through 2.10.12.04 allows remote attackers to cause a denial of service… CVSS 2.0HIGH 7.8
- TI-2007-04266 ircu 2.10.12.01 through 2.10.12.04 does not remove ops privilege after a join from a… CVSS 2.0HIGH 7.5
- TI-2007-04267 ircu 2.10.12.03 and 2.10.12.04 does not associate a timestamp with ops privilege on an… CVSS 2.0MEDIUM 6.4
- TI-2007-04270 ircu 2.10.12.05 and earlier does not properly synchronize a kick action in certain cross… CVSS 2.0MEDIUM 6.0
- TI-2007-04269 Race condition in ircu 2.10.12.01 through 2.10.12.05 allows remote attackers to set a new… CVSS 2.0MEDIUM 5.1
Sources
- CVE-2007-4411 · CVE Program
- CVE-2007-4411 · NVD
- FIRST EPSS
- GHSA-6wgv-cpj2-hjhf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences