CVE-2025-2611

The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that get executed on the server. This results in unauthenticated remote code execution in the session handling. Versions 7.4 and below are known to be vulnerable.

CVSS

No CVSS.

References

Link	Resource
https://github.com/rapid7/metasploit-framework/pull/20446
https://www.vulncheck.com/advisories/ictbroadcast-unauthenticated-session-cookie-rce
https://www.vulncheck.com/blog/ictbroadcast-kev

Configurations

No configuration.

History

04 Nov 2025, 23:15

Type	Values Removed	Values Added
CWE	~~CWE-20~~	CWE-78
References		() https://www.vulncheck.com/advisories/ictbroadcast-unauthenticated-session-cookie-rce -

Information

Published : 2025-08-05 15:15

Updated : 2025-11-04 23:15

NVD link : CVE-2025-2611

Mitre link : CVE-2025-2611

CVE.ORG link : CVE-2025-2611

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2025-2611", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "[email protected]", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "HIGH", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-08-05T15:15:29.127", "references": [{"url": "https://github.com/rapid7/metasploit-framework/pull/20446", "source": "[email protected]"}, {"url": "https://www.vulncheck.com/advisories/ictbroadcast-unauthenticated-session-cookie-rce", "source": "[email protected]"}, {"url": "https://www.vulncheck.com/blog/ictbroadcast-kev", "source": "[email protected]"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "[email protected]", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that get executed on the server. This results in unauthenticated remote code execution in the session handling.\n\n\n\n\nVersions 7.4 and below are known to be vulnerable."}, {"lang": "es", "value": "La aplicaci\u00f3n ICTBroadcast transfiere de forma insegura los datos de las cookies de sesi\u00f3n al procesamiento del shell, lo que permite a un atacante inyectar comandos de shell en una cookie de sesi\u00f3n que se ejecutan en el servidor. Esto provoca la ejecuci\u00f3n remota de c\u00f3digo no autenticado en el procesamiento de la sesi\u00f3n. Las versiones 7.4 y anteriores son vulnerables."}], "lastModified": "2025-11-04T23:15:34.350", "sourceIdentifier": "[email protected]"}