CVE-2025-2611 | THREATINT

Description

The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that get executed on the server. This results in unauthenticated remote code execution in the session handling. Versions 7.4 and below are known to be vulnerable.

PUBLISHED Reserved 2025-03-21 | Published 2025-08-05 | Updated 2025-08-06 | Assigner VulnCheck

CRITICAL: 9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H

Problem types

CWE-20 Improper Input Validation

Product status

Default status

unknown

Any version

affected

Credits

Valentin Lobstein (Chocapikk) finder

References

github.com/rapid7/metasploit-framework/pull/20446 exploit

cve.org (CVE-2025-2611)

nvd.nist.gov (CVE-2025-2611)

Download JSON