Loading story…
A critical security vulnerability, CVE-2025-2611, has been discovered in ICTBroadcast, an autodialer and call center software developed by ICT Innovations. This flaw, which scores 9.3 on the CVSS scale, arises from improper input validation that allows unauthenticated remote code execution through the BROADCAST session cookie. Attackers can inject shell commands into this cookie, which are then executed on the vulnerable server, granting them remote shell access. The vulnerability affects ICTBroadcast versions 7.4 and below, and approximately 200 instances are currently exposed to the internet, despite recommendations that such software should not be internet-facing. VulnCheck researchers observed active exploitation of this vulnerability beginning on October 11, 2025, with attacks occurring in two distinct phases. Initially, attackers use a time-based exploit check, such as a base64-encoded 'sleep 3' command, to confirm the ability to execute commands. Once confirmed, they proceed to establish reverse shells on the compromised systems. The attack payloads are delivered via specially crafted HTTP requests, leveraging the BROADCAST cookie to pass malicious commands. Some payloads have used a localto[.]net URL and the IP address 143.47.53[.]106, both of which have been previously associated with campaigns distributing the Ratty RAT malware in Europe, suggesting possible reuse of infrastructure or tooling. The vulnerability was originally discovered and reported to the vendor in March 2025 by security researcher Valentin Lobstein, who later published a Metasploit module after the vendor failed to address the issue within the 120-day disclosure window. VulnCheck has provided detection signatures for Snort and Suricata, as well as IP intelligence, to help organizations identify and mitigate exploitation attempts. There is currently no public information regarding the availability of a patch from ICT Innovations. The ongoing exploitation highlights the risk posed by internet-exposed call center software and the importance of timely vulnerability management. Security researchers emphasize the need for organizations to remove ICTBroadcast instances from public internet exposure and to monitor for signs of compromise. The overlap in indicators with previous malware campaigns raises concerns about broader threat actor activity and the potential for further attacks leveraging this vulnerability. Organizations using ICTBroadcast are urged to implement network segmentation, monitor for suspicious activity, and apply any available mitigations while awaiting an official patch. The incident underscores the criticality of secure software development practices and prompt vendor response to vulnerability disclosures.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
A CSIRT.SK advisory published on 2025-10-21 stated that CVE-2025-2611 in ICTBroadcast remained actively exploited and that no patch was available at the time. The advisory recommended restricting access to trusted IPs, validating BROADCAST cookie contents, and reviewing logs for listed indicators of compromise.
On 2025-10-15, a ProjectDiscovery Nuclei templates pull request added coverage for CVE-2025-2611 and included a Docker-based lab setup to reproduce the issue in a vulnerable ICTBroadcast environment. The submission also referenced related public exploit tooling and validation steps.
On 2025-10-14, VulnCheck published research describing CVE-2025-2611 as an actively exploited ICTBroadcast vulnerability affecting version 7.4 and below. The report documented a two-stage attack pattern involving a time-delay test and subsequent reverse-shell attempts.
VulnCheck reported that active exploitation of CVE-2025-2611 against ICTBroadcast servers began on 2025-10-11. The unauthenticated command injection flaw abuses the BROADCAST cookie to achieve remote code execution.
On 2025-05-08, Fortinet disclosed a high-severity phishing campaign using PDF invoice lures, Dropbox-hosted HTML, and Ngrok-based geo-fencing to deliver the Java-based Ratty RAT to targets in Spain, Italy, and Portugal. The report said the campaign abused the legitimate email service serviciodecorreo.es to pass SPF checks and published detection coverage and IOCs.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 18 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
5 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcegithub.com
Open sourcethehackernews.com
Open sourcevulncheck.com
Open sourcefortinet.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has identified a high-severity command injection vulnerability in Smartbedded Meteobridge devices, tracked as CVE-2025-4008, and added it to its Known Exploited Vulnerabilities (KEV) catalog due to evidence of active exploitation. This vulnerability, with a CVSS score of 8.7, resides in the Meteobridge web interface, specifically within the publicly accessible 'template.cgi' script, which is written in CGI shell scripts and C. The flaw allows remote, unauthenticated attackers to execute arbitrary commands with root privileges by sending specially crafted GET requests to the vulnerable endpoint. Security researchers from ONEKEY discovered that the vulnerability stems from insecure use of eval calls in the CGI script, enabling attackers to inject commands without any authentication or custom headers. The attack can be triggered simply by enticing a victim to visit a malicious webpage or by directly targeting exposed devices, as the CGI script is accessible without authentication. CISA’s advisory highlights that this vulnerability is being actively exploited in the wild, although no detailed public reports of exploitation techniques have been released. The vulnerability was addressed by Smartbedded in Meteobridge version 6.2, released on May 13, 2025, and users are strongly urged to update to this version to mitigate the risk. CISA’s inclusion of CVE-2025-4008 in the KEV catalog mandates that Federal Civilian Executive Branch (FCEB) agencies remediate the vulnerability by a specified due date, as per Binding Operational Directive (BOD) 22-01. The directive also encourages all organizations, not just federal agencies, to prioritize patching of KEV-listed vulnerabilities to reduce exposure to cyberattacks. The vulnerability is considered a significant risk to both federal and enterprise environments due to its ease of exploitation and the potential for attackers to gain full control of affected devices. Alongside Meteobridge, CISA’s recent KEV catalog update also included critical vulnerabilities in products from GNU Bash, Juniper, Samsung, and Jenkins, underscoring the ongoing threat posed by actively exploited flaws. The technical details provided by security researchers demonstrate that exploitation does not require advanced skills, increasing the urgency for immediate remediation. Organizations using Meteobridge devices should verify their firmware version and apply the latest updates without delay. The public advisories and catalog updates serve as a warning to the broader cybersecurity community about the importance of monitoring and addressing vulnerabilities that are known to be under active attack. Failure to remediate CVE-2025-4008 could result in unauthorized access, data compromise, or further exploitation within affected networks. CISA continues to monitor and update the KEV catalog as new evidence of exploitation emerges, reinforcing the need for proactive vulnerability management.
Jun 29, 2026
**BeyondTrust Remote Support** is being actively exploited via **CVE-2026-1731**, a **critical pre-authentication OS command injection / RCE** flaw (CVSS **9.9**) in the `thin-scc-wrapper` component exposed to the internet via **WebSocket**. Reporting indicates attackers can execute system commands without logging in, enabling rapid progression from initial access to full compromise, including reconnaissance, account creation, webshell deployment, C2 activity, lateral movement, and data theft. Victimology described to date spans multiple sectors—**financial services, healthcare, legal services, higher education, and technology/retail**—across the **U.S., France, Germany, Australia, and Canada**, with telemetry indicating **10,600+** exposed instances potentially at risk. Threat activity observed in exploitation includes deployment of two prominent remote-access backdoors: **VShell** (noted for stealthy, service-like behavior and fileless/memory execution on Linux) and **SparkRAT** (an open-source Go-based RAT previously seen in campaigns linked to *DragonSpark*). Due to confirmed exploitation, **CISA added CVE-2026-1731 to the KEV Catalog** (Feb. 13, 2026), signaling urgent patching/mitigation prioritization. Separate reporting in the same period covered unrelated critical issues in **GNU Inetutils telnetd (CVE-2026-24061)** and an exploitation surge affecting **Ivanti** products (**CVE-2025-0282/CVE-2025-0283**), but those are distinct from the BeyondTrust activity.
Jun 29, 2026
Cisco released fixes for a **critical remote code execution** vulnerability in Unified Communications and *Webex Calling Dedicated Instance*, tracked as **CVE-2026-20045**, after it was **actively exploited as a zero-day**. The issue stems from **improper validation of user-supplied input in HTTP requests** to the web-based management interface; successful exploitation can provide **user-level OS access** and enable **privilege escalation to root**. Affected products include **Cisco Unified Communications Manager (Unified CM)**, **Unified CM Session Management Edition (SME)**, **Unified CM IM & Presence**, **Cisco Unity Connection**, and **Webex Calling Dedicated Instance**; Cisco provided version-specific remediations including fixed releases and `.cop` patch files (e.g., `ciscocm.V14SU4a_CSCwr21851_remote_code_v1.cop.sha512`). CISA added **CVE-2026-20045** to its **Known Exploited Vulnerabilities (KEV) Catalog**, citing evidence of active exploitation and highlighting code injection flaws as a common attack vector with significant risk to the federal enterprise. Under **Binding Operational Directive (BOD) 22-01**, Federal Civilian Executive Branch agencies are required to remediate KEV-listed vulnerabilities by the specified due date, and CISA urged all organizations to similarly prioritize patching to reduce exposure to ongoing attacks.
Jul 23, 2026