CVE-2025-2611

critical · 9.3

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that get executed on the server. This results in unauthenticated remote code execution in the session handling. Versions 7.4 and below are known to be vulnerable.

9.3

CVSS

5.7%

EPSS (exploit prob.)

93rd

EPSS percentile

2025-08-05

Published

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weaknesses

CWE-78

References

https://github.com/rapid7/metasploit-framework/pull/20446
https://www.vulncheck.com/advisories/ictbroadcast-unauthenticated-session-cookie-rce
https://www.vulncheck.com/blog/ictbroadcast-kev

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-2611