CVE-2010-2075

Description

UnrealIRCd 3.2.8.1, as distributed on certain mirror sites from November 2009 through June 2010, contains an externally introduced modification (Trojan Horse) in the DEBUG3_DOLOG_SYSTEM macro, which allows remote attackers to execute arbitrary commands.

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

UnrealIRCD 3.2.8.1 Backdoor Command Execution
exploit/unix/irc/unreal_ircd_3281_backdoor

Exploit-DB 2

UnrealIRCd 3.2.8.1 - Backdoor Command Execution (Metasploit) EDB-16922 · remote · Dec 5, 2010 · verified
UnrealIRCd 3.2.8.1 - Remote Downloader/Execute EDB-13853 · remote · Jun 13, 2010 · verified

GitHub 11 repositories · most starred shown

MFernstrom/OffensivePascal-CVE-2010-2075 ★ 2 · May 28, 2022

FreePascal implementation of the UnrealIRCD CVE-2010-2075
rhimavanth32-max/Metasploitable2-Reconnaissance-and-UnrealIRCd-Backdoor-Exploitation ★ 1 · Sep 11, 2026

End-to-end recon and exploitation of a known backdoor (CVE-2010-2075) on Metasploitable2 using Nmap and Metasploit.
Tc-XoNoR/CVE-2010-2075 ★ 1 · Apr 16, 2026

CVE-2010-2075 exploit
FredBrave/CVE-2010-2075-UnrealIRCd-3.2.8.1 ★ 1 · May 31, 2023

Exploit for CVE:2010-2075. This exploit allows remote command execution in UnrealIRCd 3.2.8.1.
chancej715/UnrealIRCd-3.2.8.1-Backdoor-Command-Execution ★ 1 · Apr 25, 2023

UnrealIRCd 3.2.8.1 backdoor command execution exploit in Python 3 (CVE-2010-2075).
zales2004/sunset-noontide-pentesting ★ 0 · Sep 12, 2026

Description Professional penetration testing assessment of the Sunset: Noontide VulnHub machine, covering reconnaissance, service enumeration, CVE-2010-2075 exploitation, post-exploitation, privilege…
Elazab2005/unrealircd-backdoor-pentest-report ★ 0 · Aug 20, 2026

Controlled PenTest lab report for UnrealIRCd 3.2.8.1 backdoor (CVE-2010-2075) on Metasploitable3 with remediation steps.
mishaqdev/cve-2010-2075-analysis ★ 0 · Jun 5, 2026

Technical writeup and penetration testing report for CVE-2010-2075, demonstrating UnrealIRCd backdoor exploitation and remediation.
earthbendergara/unrealircd3.2.8.1-local-exploit ★ 0 · Nov 28, 2025

CVE-2010-2075
JoseLRC97/UnrealIRCd-3.2.8.1-Backdoor-Command-Execution ★ 0 · Apr 18, 2024

Script that exploits the vulnerability that allows establishing a backdoor in the UnrealIRCd service with CVE-2010-2075

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References

http://www.unrealircd.com/txt/unrealsecadvisory.20100612.txt
ADV-2010-1437 vdb-entry
GLSA-201006-21 vendor-advisory
65445 vdb-entry
[oss-security] 20100614 Re: CVE request: UnrealIRCd 3.2.8.1 source code contained a backdoor allowing for remote command execution mailing-list
13853 exploit
40169 third-party-advisory
20100612 Fw: [irc-security] UnrealIRCd 3.2.8.1 backdoored on official ftp and site mailing-list
40820 vdb-entry
20100612 Re: Fw: [irc-security] UnrealIRCd 3.2.8.1 backdoored on official ftp and site mailing-list