CVE-2025-2611 is an OS command injection vulnerability in ICT Innovations ICTBroadcast where session cookie data is improperly neutralized before being passed to shell processing. This allows unauthenticated remote attackers to execute arbitrary commands on the server by injecting malicious shell commands into session cookies. Versions 7.4 and earlier are affected. The vulnerability is classified under CWE-78 and has a CVSS 4.0 base score of 9.3, indicating critical impact with network attack vector, no privileges required, and no user interaction needed.

Successful exploitation results in unauthenticated remote code execution on the server hosting ICTBroadcast. This can lead to full system compromise, data theft, service disruption, or further network penetration. The vulnerability affects session handling, which is critical for application security and user session integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the ICTBroadcast service to trusted networks and monitor for suspicious activity related to session cookies. Avoid exposing the service directly to untrusted networks. Follow up with ICT Innovations for updates on patches or official mitigations.