{"affected":[{"defaultStatus":"unknown","platforms":["Linux"],"product":"ICTBroadcast","source":"CNA: VulnCheck","vendor":"ICT Innovations","versions":[{"lessThanOrEqual":"7.4","status":"affected","version":"0","versionType":"custom"}]}],"cveId":"CVE-2025-2611","cwes":["CWE-78"],"description":"The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that get executed on the server. This results in unauthenticated remote code execution in the session handling.\n\n\n\n\nVersions 7.4 and below are known to be vulnerable.","epss":{"date":"2026-11-08","percentile":0.95007,"score":0.08378},"exploits":[{"kind":"exploit","source":"CNA: VulnCheck","url":"https://www.vulncheck.com/blog/ictbroadcast-kev"}],"kev":null,"metrics":[{"score":9.3,"severity":"critical","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:H/SI:H/SA:H","version":"4.0"}],"modifiedAt":1794146411803,"publishedAt":1754406032531,"references":[{"source":"CNA: VulnCheck","tags":["issue-tracking","patch"],"url":"https://github.com/rapid7/metasploit-framework/pull/20446"},{"source":"CNA: VulnCheck","tags":["technical-description","exploit"],"url":"https://www.vulncheck.com/blog/ictbroadcast-kev"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/ictbroadcast-unauthenticated-session-cookie-rce"}],"remediation":[{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/rapid7/metasploit-framework/pull/20446"}],"revision":"950bbb80709186705fdfba1d1622df96aa0523a8a1e3d9365140d508b3337134","sources":[{"modifiedAt":1794146411803,"name":"CNA: VulnCheck","retrievedAt":1794146957876,"url":"https://www.cve.org/CVERecord?id=CVE-2025-2611"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794150556095,"url":"https://api.first.org/data/v1/epss?cve=CVE-2025-2611"}],"ssvc":{"assessedAt":1754406366580,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"ICTBroadcast <= 7.4 Unauthenticated Session Cookie RCE","updatedAt":1794150556095}