Vulnerability · Published Aug 5, 2025 · Assigned by VulnCheck

CVE-2025-2611ICTBroadcast <= 7.4 Unauthenticated Session Cookie RCE

Critical 9.3

In plain English

A critical-severity OS command injection in ICTBroadcast from ICT Innovations. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 8.4% (higher than 95% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei.

Severity (CVSS 4.0)9.3Critical

Exploit odds (30 days)8.4%top 5.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling2Metasploit, Nuclei

Official description

The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that get executed on the server. This results in unauthenticated remote code execution in the session handling. Versions 7.4 and below are known to be vulnerable.

Affected products (as reported)

Vendor	Product	Versions
ICT Innovations	ICTBroadcast	0 – through 7.4

Weakness: CWE-78 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H

References

https://github.com/rapid7/metasploit-framework/pull/20446 issue-tracking
https://www.vulncheck.com/blog/ictbroadcast-kev technical-description, exploit
https://www.vulncheck.com/advisories/ictbroadcast-unauthenticated-session-cookie-rce third-party-advisory