CVE-2025-2611 — ICTBroadcast <= 7.4 Unauthenticated Session Cookie RCE
The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that get executed on th…
Published: 2025-08-05 · CVSS: 9.3 · CVSS 4.0
The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that get executed on the server. This results in unauthenticated remote code execution in the session handling. Versions 7.4 and below are known to be vulnerable.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7