---
id: CVE-2025-2611
title: ICTBroadcast <= 7.4 Unauthenticated Session Cookie RCE
summary: >-
  The ICTBroadcast application unsafely passes session cookie data to shell
  processing, allowing an attacker to inject shell commands into a session
  cookie that get executed on the server. This results in unauthenticated remote
  code execut…
severity: critical
cvss: 9.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H'
cvssSource: cna
cwe:
  - CWE-78
vendor: ICT Innovations
product: ICTBroadcast
affected:
  - ICTBroadcast <= 7.4
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2025-08-05T15:06:06.580478Z'
exploitAvailable: true
published: '2025-08-05'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:00:11.803Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-2611'
references:
  - url: 'https://github.com/rapid7/metasploit-framework/pull/20446'
  - url: 'https://www.vulncheck.com/blog/ictbroadcast-kev'
  - url: >-
      https://www.vulncheck.com/advisories/ictbroadcast-unauthenticated-session-cookie-rce
tags:
  - cve.org
  - exploit-available
epss: 0.08378
epssPercentile: 0.95007
exploits:
  metasploit:
    - exploit/linux/http/ictbroadcast_unauth_cookie
  nuclei:
    - CVE-2025-2611
  checkedAt: '2026-11-08T14:51:57.353Z'
ingestedAt: '2026-11-08T14:51:22.487Z'
---

## Overview

The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that get executed on the server. This results in unauthenticated remote code execution in the session handling.




Versions 7.4 and below are known to be vulnerable.

## Affected

- `ICTBroadcast <= 7.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.