CVE-2025-2611

CVE-2025-2611 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 1 public exploit from researchers including Valentin Lobstein, including a Metasploit module exploits/linux/http/ictbroadcast_unauth_cookie. A Nuclei detection template is also available.

AI-analyzed exploit summary This Metasploit module exploits an unauthenticated RCE vulnerability in ICTBroadcast by injecting arbitrary commands into session cookies. It dynamically retrieves valid cookies and injects a base64-encoded payload via backtick command substitution.

The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that get executed on the server. This results in unauthenticated remote code execution in the session handling. Versions 7.4 and below are known to be vulnerable.