by Kastro
Paper/Archive/CVE-2025-2611

CVE-2025-2611

ICT Innovations ICTBroadcast — ICTBroadcast <= 7.4 Unauthenticated Session Cookie RCE

EPSS 8%CVSS 9.3
critical.is priorityof 100
47
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 94.9.949 × 2019.0No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that get executed on the server. This results in unauthenticated remote code execution in the session handling. Versions 7.4 and below are known to be vulnerable.

Affected

ProductAffectedFixed inSource
ICTBroadcast≤ 7.4–CNA

Scores by source

VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refgithub.com/rapid7/metasploit-framework/pull/20446exploitvulncheck.com/blog/ictbroadcast-kevwriteupvulncheck.com/advisories/ictbroadcast-unauthenticated-session-cookie-rce