Pexip Infinity
CVE-2025-66379
HIGH
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach exposed Pexip media node
-
DeliverySend crafted media stream
-
ExploitTrigger improper input validation
-
ExecutionSoftware abort (CWE-617)
-
ImpactMedia service denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V16 - Security Logging and Error Handling Reachable assertion handling
|
| Exploitation Conditions | Exploitation requires network reachability to the Pexip Infinity media implementation and the ability to send a crafted media stream to it; per the CVSS vector no authentication (PR:N) and no user interaction (UI:N) are needed against affected versions (before 39.0). The practical limiting factor is network exposure of the media/conferencing nodes - deployments that restrict media traffic to trusted networks or place nodes behind filtering reduce reachability. Impact is confined to availability (media service abort/DoS); there is no confidentiality or integrity effect, and the fix is available in version 39.0. |
| Impact | The CVSS vector (AV:N/AC:L/PR:N/UI:N/A:H, base 7.5) describes a remotely reachable, unauthenticated, low-complexity denial-of-service with no confidentiality or integrity impact - an availability-only issue consistent with CWE-617 (reachable assertion / software abort). No EPSS score is supplied in the input and there is no CISA KEV listing and no public POC referenced, so exploitation status is 'no public exploit identified at time of analysis.' The realistic risk is that of a service-crash bug: a single crafted media stream aborts the media component, degrading or dropping video/voice sessions, but it does not yield code execution or data exposure. This is a genuine availability concern for organizations that expose Pexip Infinity conferencing nodes to untrusted networks, but it is a moderate-priority patch item rather than a critical breach risk - the 7.5 score is driven entirely by A:H, and the absence of KEV/POC/EPSS signals means there is no evidence of active or automated exploitation at this time. Verify against Pexip's own security bulletin, as the only reference is a generic bulletin index page rather than a per-CVE advisory. |
| Exploit ScenarioDerived | A remote, unauthenticated attacker who can reach a Pexip Infinity conferencing/media node sends a specially crafted media stream to the media implementation, triggering improper input validation that leads to a software abort. The affected media process crashes, disrupting active or new conference sessions until the service recovers. No public exploit code is identified, and the attack requires no privileges or user interaction (PR:N/UI:N). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Remote unauthenticated attackers can trigger a software abort (denial of service) in Pexip Infinity media implementations before version 39.0 by sending a crafted media stream. The flaw, tracked as CVE-2025-66379, requires network access to the media service but no authentication or user interaction (CVSS 7.5, availability-only). No public exploit code or active exploitation has been identified at time of analysis; the vendor has addressed the issue in Pexip Infinity 39.0.
RemediationAI
Upgrade to Pexip Infinity 39.0 or later. For immediate mitigation, restrict network access to the media implementation to trusted sources only, as the attack requires sending a crafted media stream. This may involve firewall rules or network segmentation, with the trade-off of limiting legitimate media traffic from untrusted networks. Disabling the media service entirely is not recommended as it would break conferencing functionality. Refer to the vendor security bulletin at https://docs.pexip.com/admin/security_bulletins.htm for patch details and any additional guidance.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Pexip Infinity is a videoconferencing platform that processes real-time media streams (e.g., RTP/RTCP) for conferencing. The vulnerability is rooted in improper input validation within the media implementation, leading to a reachable assertion (CWE-617) that causes the software to abort, resulting in a denial of service. The CPE string cpe:2.3:a:pexip:pexip_infinity:*:*:*:*:*:*:*:* indicates that all versions before 39.0 are affected. The attack vector is network-based (AV:N), low complexity (AC:L), and requires no privileges (PR:N) or user interaction (UI:N), as confirmed by the CVSS vector. The impact is strictly availability (A:H), with no confidentiality or integrity impact.
Know when Pexip Infinity gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated crafted media stream with low complexity and no interaction causes a software abort; availability-only impact, no scope change.
Primary rating from Vendor (mitre).
CVSS VectorVendor: mitre
DescriptionCVE.org
Pexip Infinity before 39.0 has Improper Input Validation in the media implementation, allowing a remote attacker to trigger a software abort via a crafted media stream, resulting in a denial of service.
Executive ViewAI
Pexip Infinity video conferencing deployments that handle media streams can be knocked offline by a crafted stream sent from the network, disrupting meetings and any real-time communications the organization or its customers depend on that platform. The exposure is availability-only and does not involve data theft, but the service is typically reachable from outside the trusted perimeter, so disruption requires no credentials or user action and can be repeated at will. Leadership should treat this as an operational resilience issue for all platform users, with a vendor fix already identified in version 39.0.
Apply vendor patch (Pexip Infinity 39.0); until the upgrade is complete, restrict network access to media services to trusted sources and filter anomalous media traffic at the perimeter.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
More in Pexip Infinity
View allPexip Infinity before 8 uses the same SSH host keys across different customers' installations, which allows man-in-the-m
Pexip Infinity before 14.2 allows remote attackers to cause a denial of service (service restart) or execute arbitrary c
Pexip Reverse Proxy and TURN Server before 6.1.0 has Incorrect UDP Access Control via TURN. Rated critical severity (CVS
Improper access control in the Pexip Infinity Secure Scheduler for Exchange service, when configured with deprecated Off
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via One Touch Join. Rated high severity (
Pexip Infinity before 27.3 allows remote attackers to trigger a software abort, and possibly enumerate usernames, via On
Signalling in Pexip Infinity 29 through 36.2 before 37.0 has improper input validation that allows remote attackers to t
Pexip Infinity before 35.0 has improper input validation that allows remote attackers to trigger a denial of service (so
Missing authentication for a critical function in Pexip Infinity's product-internal API, present in all releases before
Unauthenticated remote attackers can forcibly disconnect RTMP streams that traverse a Proxy Node in Pexip Infinity 38.0
Unauthenticated network attackers can crash Pexip Infinity 35.0 through 37.2 by sending crafted input to its signalling
Denial of service in Pexip Infinity 33.0 through 37.0 can be triggered by unauthenticated remote attackers who send craf
GitHub PoC
Exploit-DB