The UnrealIRCd label‑response module fails to escape the IRCv3 "label" message tag when it echoes that tag back into responses. This deficiency allows an attacker to embed malicious server-to-server commands inside the label tag. The injected commands are then executed with the privileges of the server, enabling arbitrary command execution on that server. The vulnerability inherits the characteristics of CWE‑140, which describes issues of improper handling of input length or content that can lead to injection. Attackers can create a specially crafted IRC message containing a label tag that includes additional commands. When the server processes this message, it concatenates the label directly into outgoing content, inadvertently injecting the commands into interserver traffic. This flaw is significant for networks running UnrealIRCd 6.0.0 through 6.2.7.0 that have two or more linked servers. The presence of a second server provides the necessary channel for the injected commands to travel and be executed. The impact allows full server authority, providing an attacker potential to compromise or disrupt the entire server infrastructure or the connected network.

UnrealIRCd 6.0.0 up to 6.2.7.0 deployed on any server that participates in a network with at least two linked servers. The issue does not affect newer releases 6.2.7.1 or later. The specific vendor model is UnrealIRCd, as identified by its CNA, and the configuration change applies to all UnrealIRCd servers in the network. Systems utilizing older versions without the labeled-response module remain unaffected, provided the module is not loaded. Any instance of UnrealIRCd that is part of a multi‑link environment is at risk until the module is upgraded, hot‑patched, or the configuration blacklist is applied.

The CVSS base score of 8.6 marks this flaw as high severity, reflecting the potential for unauthorized command execution on the server with full authority. EPSS data is not available, so the exploitation probability cannot be quantified, though the absence of exploitation data in public sources does not diminish the risk posed by the flaw. The vulnerability is not listed in the CISA KEV catalog, but the attack vector remains effective in any network with two or more linked servers, where the injected label tag can travel between servers and be interpreted as a command. The most likely attack path involves a malicious client sending a crafted IRC message that includes a label tag containing command syntax. The UnrealIRCd server, in processing the message, propagates the label to other servers, unwittingly executing the malicious payload with server privileges. The simplicity of constructing such a message and the potential for broad impact make this an attractive target for attackers operating in multi‑link IRC environments.