Pexip Infinity
CVE-2025-48704
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach Pexip signalling endpoint over network
-
DeliveryCraft malformed signalling message
-
ExploitSend to trigger input-validation failure
-
ExecutionReachable assertion causes software abort
-
ImpactConferencing service denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V16 - Security Logging and Error Handling Reachable assertion handling
|
| Exploitation Conditions | Exploitation requires network reachability to the Pexip Infinity signalling interface on an affected version (35.0 through 37.2; fixed in 38.0). Per the CVSS vector (AV:N/AC:L/PR:N/UI:N) no authentication or user interaction is needed, and the flaw is reachable against the signalling path without a described non-default configuration. The primary limiting factor is network exposure of the signalling interface: deployments that restrict signalling to trusted networks or segment Pexip behind controls materially reduce exposure, and impact is confined to availability (service abort/restart) with no data or integrity effect. Upgrading to 38.0 or later removes the condition. |
| Impact | This is a network-exploitable, unauthenticated denial-of-service flaw (CVSS 7.5, AV:N/AC:L/PR:N/UI:N) in Pexip Infinity signalling, mapped to CWE-617 (Reachable Assertion), meaning crafted input triggers a software abort rather than code execution - impact is availability-only (C:N/I:N/A:H). No EPSS score was provided in the input, and there is no CISA KEV listing and no public exploit identified at time of analysis, so there is no public evidence of active exploitation or weaponization. The 7.5 score is driven entirely by the ease of reaching the fault (low complexity, no auth, no user interaction) combined with full service-availability loss, not by data compromise. Realistically this is a moderate-priority, patch-in-normal-cycle issue for organizations exposing Pexip signalling to untrusted networks, and higher priority where Pexip is internet-facing and business-critical for conferencing; it is not a critical remote-code-execution emergency. Note the input provides no EPSS value and no vendor advisory detail beyond a generic security-bulletins URL, so the real-world exploitation likelihood cannot be quantified from the supplied data - verify affected versions and fix against the Pexip bulletin. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker with network reachability to a Pexip Infinity node (versions 35.0 through 37.2) sends specially malformed signalling traffic that fails input validation and triggers a reachable assertion/software abort, crashing the affected process. Repeated requests keep the conferencing service unavailable to legitimate users. No public proof-of-concept was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 07, 2026
Unauthenticated network attackers can crash Pexip Infinity 35.0 through 37.2 by sending crafted input to its signalling interface, triggering a software abort that takes the service down. The flaw is rated CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) with impact confined to availability (C:N/I:N/A:H), so it degrades or halts conferencing services rather than exposing or altering data. No public exploit identified at time of analysis and no CISA KEV listing, but exposure is a function of network reachability to the signalling path; upgrading to 38.0 removes the condition.
RemediationAI
Upgrade Pexip Infinity to 38.0 or later, which is the vendor-released patch for CVE-2025-48704; confirm the target build against the vendor security bulletins page at https://docs.pexip.com/admin/security_bulletins.htm before and after the change. Until the upgrade is complete, restrict network reachability to the signalling interface so that only trusted networks, peers, and conferencing endpoints can reach it - placing Pexip behind segmentation or firewall rules materially cuts exposure, though it also blocks legitimate federated or remote participants and must be scoped carefully. Because exploitation requires no authentication or user interaction, do not rely on credential controls or user awareness as a mitigation; limit the exposure window by scheduling the upgrade promptly and monitor for unexpected service aborts or restarts that would indicate an exploitation attempt.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Pexip Infinity is a conferencing and video-interoperability platform whose signalling components negotiate call and session setup. The defect maps to CWE-617 (Reachable Assertion): the signalling code fails to validate incoming input properly, and malformed or unexpected data drives execution into a state where the process deliberately aborts itself. This is an assertion/abort condition rather than memory corruption, which is why the assessed impact is availability-only - the process terminates or restarts, interrupting active sessions and service. The affected CPE is pexip:pexip_infinity across versions 35.0 through 37.2, with the fix landing in 38.0. Because the CVSS vector carries PR:N and UI:N, the abort can be reached over the network without credentials or user action, making any internet- or partner-facing signalling listener a practical target.
Know when Pexip Infinity gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable signalling with no auth or interaction and low complexity yields AV:N/AC:L/PR:N/UI:N; reachable-assertion abort gives availability-only impact (A:H, C:N/I:N).
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
Pexip Infinity 35.0 through 37.2 before 38.0 has Improper Input Validation in signalling that allows an attacker to trigger a software abort, resulting in a denial of service.
Executive ViewAI
Pexip Infinity versions 35.0 through 37.2 are vulnerable to an unauthenticated network attack that can crash the signalling interface, causing conferencing services to become unavailable. This availability disruption can affect any organization relying on Pexip for video conferencing, potentially hindering internal communications, remote collaboration, and customer-facing meetings. Leadership should prioritize mitigation because the flaw is remotely exploitable without credentials, even though no public exploit identified at time of analysis.
Restrict network access to the signalling interface to trusted sources via firewall/ACL; segment Pexip Infinity from untrusted networks; enable rate limiting and anomaly detection on signalling traffic; monitor for service crashes and failover to redundant instances; plan upgrade to Pexip Infinity 38.0 as soon as it is available and validated.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
More in Pexip Infinity
View allPexip Infinity before 8 uses the same SSH host keys across different customers' installations, which allows man-in-the-m
Pexip Infinity before 14.2 allows remote attackers to cause a denial of service (service restart) or execute arbitrary c
Pexip Reverse Proxy and TURN Server before 6.1.0 has Incorrect UDP Access Control via TURN. Rated critical severity (CVS
Improper access control in the Pexip Infinity Secure Scheduler for Exchange service, when configured with deprecated Off
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join. Rated high severity (
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort, and possibly enumerate usernames, via On
Signalling in Pexip Infinity 29 through 36.2 before 37.0 has improper input validation that allows remote attackers to t
Pexip Infinity before 35.0 has improper input validation that allows remote attackers to trigger a denial of service (so
Remote unauthenticated attackers can trigger a software abort (denial of service) in Pexip Infinity media implementation
Missing authentication for a critical function in Pexip Infinity's product-internal API, present in all releases before
Unauthenticated remote attackers can forcibly disconnect RTMP streams that traverse a Proxy Node in Pexip Infinity 38.0
Denial of service in Pexip Infinity 33.0 through 37.0 can be triggered by unauthenticated remote attackers who send craf
GitHub PoC
Exploit-DB