CVE-2025-66443

Pexip Infinity 35.0 through 38.1 before 39.0, in non-default configurations that use Direct Media for WebRTC, has Improper Input Validation in signalling that allows an attacker to trigger a software abort, resulting in a temporary denial of service.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://docs.pexip.com/admin/security_bulletins.htm	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:pexip:pexip_infinity:*:*:*:*:*:*:*:*

History

07 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Pexip Infinity 35.0 hasta 38.1 antes de 39.0, en configuraciones no predeterminadas que usan Direct Media para WebRTC, tiene una validación de entrada incorrecta en la señalización que permite a un atacante activar una interrupción de software, lo que resulta en una denegación de servicio temporal.

Information

Published : 2025-12-25 05:16

Updated : 2026-10-07 13:10

NVD link : CVE-2025-66443

Mitre link : CVE-2025-66443

CVE.ORG link : CVE-2025-66443

JSON object : View

Products Affected

pexip

pexip_infinity

CWE

CWE-617

Reachable Assertion

{"id": "CVE-2025-66443", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66443", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-26T14:49:26.665442Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cve@mitre.org", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "cve@mitre.org", "affectedData": [{"vendor": "Pexip", "product": "Infinity", "versions": [{"status": "affected", "version": "35.0", "lessThan": "39.0", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2025-12-25T05:16:09.803", "references": [{"url": "https://docs.pexip.com/admin/security_bulletins.htm", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cve@mitre.org", "description": [{"lang": "en", "value": "CWE-617"}]}], "descriptions": [{"lang": "en", "value": "Pexip Infinity 35.0 through 38.1 before 39.0, in non-default configurations that use Direct Media for WebRTC, has Improper Input Validation in signalling that allows an attacker to trigger a software abort, resulting in a temporary denial of service."}, {"lang": "es", "value": "Pexip Infinity 35.0 hasta 38.1 antes de 39.0, en configuraciones no predeterminadas que usan Direct Media para WebRTC, tiene una validaci\u00f3n de entrada incorrecta en la se\u00f1alizaci\u00f3n que permite a un atacante activar una interrupci\u00f3n de software, lo que resulta en una denegaci\u00f3n de servicio temporal."}], "lastModified": "2026-10-07T13:10:00.713", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:pexip:pexip_infinity:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D923C0AB-825B-4876-8C54-F6D9247964E1", "versionEndExcluding": "39.0", "versionStartIncluding": "35.0"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}