Cloudanix VulnDB

CVE-2019-6453

High · 8.1

CVSS

8.1

EPSS

54.6%

Published

Feb 18, 2019

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Attend

Outdated chat software can be tricked into running attacker commands when someone clicks a specially crafted link in certain web browsers.

Exploit Available
Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
High
Impact
Remote Code Execution
Component
Application
Class
Command Injection
Remediation
Upgrade
Effort
Low
Patch risk
Low

What it actually does

Remote command execution achieved by injecting arguments into custom irc:// URI protocol handlers, allowing an attacker-specified .ini file from a UNC share to be loaded and executed.

Why it matters to the business

Attackers can gain remote control of user systems running outdated mIRC clients, enabling data theft, malware deployment, or lateral movement with moderate operational disruption risk given the age of the flaw and limited browser compatibility.

How an attack unfolds

An attacker crafts a malicious irc:// URI referencing an arbitrary .ini file hosted on a UNC share; when a victim using a vulnerable browser (excluding Chrome) clicks the link, mIRC processes the URI, loads the attacker-controlled configuration, and executes injected commands.

How to fix it

Upgrade mIRC to version 7.55 or later; disable or restrict custom URI protocol handlers where upgrade is not immediately feasible.

How to confirm the fix worked

Verify installed mIRC version is 7.55 or newer; test URI handling behavior with crafted irc:// links in supported browsers and confirm no external .ini loading occurs.

Typical attack path

  1. Attacker hosts a malicious .ini file on a reachable UNC share
  2. Attacker crafts and distributes an irc:// URI embedding the UNC path
  3. Victim clicks the URI in a supported browser, triggering mIRC
  4. mIRC loads the remote .ini and executes attacker-supplied commands

How to detect it

Review browser history and process creation logs for invocations of mirc.exe with irc:// arguments containing UNC paths; inspect Windows registry protocol handler entries and recent .ini file loads from network locations.

  • mirc.exe.*irc://.*\\\\
  • Process creation events showing mIRC loading .ini from \\ paths

What your security team should do

  • Immediately upgrade all mIRC installations to 7.55 or later
  • Audit and restrict custom protocol handler registrations in browsers and Windows
  • Monitor for any remaining legacy mIRC deployments and enforce endpoint application control

The record

mIRC before 7.55 allows remote command execution by using argument injection through custom URI protocol handlers. The attacker can specify an irc:// URI that loads an arbitrary .ini file from a UNC share pathname. Exploitation depends on browser-specific URI handling (Chrome is not exploitable).

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities