Pexip Infinity CVE-2025-66377

Exploitation requires the attacker to ALREADY have code-execution on at least one node within a Pexip Infinity installation - this is a lateral-movement primitive, not initial access. Given that foothold, the attacker abuses a product-internal API that is missing authentication for a critical function, reachable over the adjacent inter-node network (AV:A), to affect other nodes. Limiting factors: requires an existing node compromise, adjacent (not remote-internet) network position to the internal API, high attack complexity (AC:H), and a multi-node deployment for the cross-node impact to matter. Affected: Pexip Infinity before version 39.0.

Signals are moderate and internally consistent. The vendor/NVD CVSS 3.1 vector (AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 7.5) describes an adjacent-network, high-complexity attack with full CIA impact but no scope change. The most important risk-limiting fact comes from the description itself, not the vector: the attacker 'already has access to execute code on one node' - i.e., this is a post-compromise lateral-movement / blast-radius primitive, not an initial entry point. PR:N is technically correct because the product-internal API performs no authentication, but that PR:N materially overstates accessibility since a prior code-execution foothold on a Pexip node is a hard prerequisite. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or automated weaponization. Net: a real, worth-patching defense-in-depth issue that contains a breach rather than a high-urgency internet-facing emergency. This is a legitimately-rated medium/high flaw, not a high-CVSS-but-trivial-risk case, but also not a mass-exploitation candidate.

An attacker who has already achieved code execution on one node of a multi-node Pexip Infinity deployment (e.g., via a separate vulnerability or misconfiguration) reaches the unauthenticated internal API exposed on the adjacent inter-node management network. Because the critical function requires no authentication, the attacker issues API calls that disrupt or manipulate the operation of other nodes in the installation, expanding a single-node compromise across the cluster. No public exploit code was identified at time of analysis.