Back to KEVs

CVE-2025-2611

ICTBroadcast <= 7.4 Unauthenticated Session Cookie RCE

Basic Information

CVE State
PUBLISHED
Reserved Date
March 21, 2025
Published Date
August 05, 2025
Last Updated
November 04, 2025
Vendor
ICT Innovations
Product
ICTBroadcast
Description
The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that get executed on the server. This results in unauthenticated remote code execution in the session handling. Versions 7.4 and below are known to be vulnerable.
Tags
nuclei_scanner

CVSS Scores

CVSS v4.0

9.3 - CRITICAL

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H

SSVC Information

Exploitation
none
Automatable
Yes
Technical Impact
partial

Exploit Status

Exploited in the Wild
Yes (2025-10-15 17:56:53 UTC) Source

References

https://github.com/rapid7/metasploit-framework/pull/20446 https://www.vulncheck.com/blog/ictbroadcast-kev https://www.vulncheck.com/advisories/ictbroadcast-unauthenticated-session-cookie-rce

Known Exploited Vulnerability Information

Source Added Date
The Shadowserver (via CIRCL) 2025-10-15 17:56:53 UTC

Scanner Integrations

Scanner URL Date Detected
Nuclei https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2611.yaml 2026-06-01 15:34:41 UTC

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Added to KEVIntel

  • Detected by Nuclei