ICTBroadcast - Command Injection

CVE-2025-2611

Verified

Description

The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that get executed on the server. This results in unauthenticated remote code execution in the session handling. Versions 7.4 and below are known to be vulnerable.

Severity

Critical

CVSS Score

9.8

Exploit Probability

Published Date

October 15, 2025

Template Author

chocapikk

CVE-2025-2611.yaml

9.8Score

CVSS Metrics

CVSS Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVE ID:

cve-2025-2611

CWE ID:

cwe-78

References

https://www.vulncheck.com/blog/ictbroadcast-kev https://nvd.nist.gov/vuln/detail/CVE-2025-2611

Remediation Steps

Update to a version later than 7.4 or the latest available version.

ICTBroadcast - Command Injection

Description

Severity

CVSS Score

Exploit Probability

Published Date

Template Author

Nuclei Template

CVSS Metrics

References

Remediation Steps

ICTBroadcast - Command Injection

Description

Severity

CVSS Score

Exploit Probability

Published Date

Template Author

Nuclei Template

CVSS Metrics

References

Remediation Steps