# CVE-2025-2611: ICTBroadcast - RCE

> Live exploitation tracking for CVE-2025-2611 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-2611

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** ICTInnovations ICTBroadcast
- **Weaknesses:** CWE-78 (Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'))
- **Tags:** web_application

## Description

ICTBroadcast unsafely passes session cookie data to shell processing, allowing an unauthenticated attacker to inject shell commands into a session cookie that get executed on the server.

## CrowdSec analysis

[CVE-2025-2611](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-2611) is a critical unauthenticated remote code execution vulnerability in ICTBroadcast. The application unsafely passes session cookie data to shell processing, allowing attackers to inject and execute arbitrary commands through crafted cookie values.

CrowdSec has been tracking this vulnerability and its exploits since 22nd of October 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2025-2611 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Attackers exploit the `/login.php` endpoint by injecting shell commands (backtick or `$(`) into the session Cookie header value, which the server's session handling code passes directly to shell execution.

## Timeline

- 2025-03-20: CVE Published. CVE-2025-2611 is published to NVD.
- 2025-10-22: Rule Released. CrowdSec releases a rule to detect CVE-2025-2611 exploitation attempts against the CrowdSec Network.
- 2025-11-22: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-2611 for the first time.

## References

- https://www.vulncheck.com/blog/ictbroadcast-kev
- https://nvd.nist.gov/vuln/detail/CVE-2025-2611
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-2611.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-2611) follows observed exploitation activity for CVE-2025-2611. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.