Hackers Target ICTBroadcast Servers via Cookie Exploit to Gain Remote Shell Access
Summary: Researchers disclosed active exploitation of CVE-2025-2611, a CVSS 9.3 improper input validation flaw in ICT Innovations' ICTBroadcast autodialer software that lets unauthenticated attackers inject shell commands through the BROADCAST session cookie and execute code on the server. VulnCheck detected in-the-wild attacks on October 11 in two phases - a time-based check using a Base64-encoded "sleep 3" command, then reverse shell setup - with roughly 200 online instances exposed, and said it cannot confirm that the vendor's 7.2.12 fix is available or resolves the issue.
Why it matters: About 200 exposed ICTBroadcast instances are running software where a single crafted cookie yields a remote shell, and the indicators overlap with infrastructure Fortinet previously tied to a Ratty RAT campaign against organizations in Spain, Italy, and Portugal - suggesting shared tooling and an actor already active in the region.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-2611
- Related
- Sneeit Word Press RCE Exploited in the Wild While ICTBroadcast Bug Fuels Frost Botnet Attacks Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026