Hackers Target ICTBroadcast Servers via Cookie Exploit to Gain Remote Shell Access
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-2611 | The ICTBroadcast application unsafely passes session cookie data to shell processing, allowing an attacker to inject shell commands into a session cookie that… | 9.3 | 6% |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | localto.net | cution and then create reverse shells. "The attacker used a localto[.]net URL in the mkfifo + nc payload, and also made connections |
| ipv4 | 143.47.53.106 | RL in the mkfifo + nc payload, and also made connections to 143.47.53[.]106 in other payloads," Baines noted. It's worth noting that |
From the original article
2 min read at thehackernews.com
Ravie Lakshmanan Oct 15, 2025 Vulnerability / Server Security Cybersecurity researchers have disclosed that a critical security flaw impacting ICTBroadcast, an autodialer software from ICT Innovations, has come under active exploitation in the wild. The vulnerability, assigned the CVE identifier CVE-2025-2611 (CVSS score: 9.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.