autodialer

Critical ICTBroadcast flaw (CVE-2025-2611) exploited to deploy reverse shells

Cybercrime, News, Vendors, Vulnerabilities

October 15, 2025

A critical input-validation flaw in ICTBroadcast (CVE-2025-2611, CVSS 9.3) allows unauthenticated command injection via a session cookie; researchers including VulnCheck say the bug is being exploited to run reverse shells on exposed servers, and no patch information is currently available.