Hackers Target ICTBroadcast Servers via Cookie Exploit to Gain Remote Shell Access

Cybersecurity researchers have disclosed a critical security flaw in ICTBroadcast, an autodialer from ICT Innovations, that is being actively exploited in the wild. The vulnerability, CVE-2025-2611 with a CVSS of 9.3, stems from improper input validation that can lead to unauthenticated remote code execution by the application passing session cookie data to shell processing, allowing attackers to inject shell commands into a session cookie.

It affects ICTBroadcast versions 7.4 and below, with attackers reportedly using the BROADCAST cookie to gain remote code execution, according to VulnCheck's Jacob Baines. Exploitation was detected in the wild on 11 October, occurring in two phases: a time-based exploit check followed by attempts to set up reverse shells.

VulnCheck noted that unknown threat actors have been observed injecting a Base64-encoded command that translates to “sleep 3” in the BROADCAST cookie to confirm command execution, and then creating reverse shells, with approximately 200 online instances exposed. There is currently no information available on the patch status, and ICT Innovations has been contacted for comment.